Microsoft Disrupts Ransomware Campaign Abusing Azure Certificates

Microsoft disrupted a Rhysida ransomware campaign that used fake Teams binaries signed with digital certificates, including many from Microsoft’s own service. According to Microsoft Threat Intelligence, the firm revoked more than 200 code-signing certificates issued by Azure’s Trusted Signing service, certificates that threat actors can abuse to make malware appear legitimate.

The group Vanilla Tempest, tracked by Microsoft as Vanilla Tempest and also known as Vice Society, crafted the fake Teams files to drop a backdoor called Oyster, enabling Rhysida to be delivered in victims’ networks. In addition to Trusted Signing, the attackers also acquired certificates from SSL[.]com, DigiCert, and GlobalSign to authenticate their installers and tools, Microsoft said. Signing such files with valid certificates helps them evade detection, making the fake binaries look like real software.

The post notes it is unclear how Vanilla Tempest obtained the Trusted Signing certificates, which Microsoft describes as a managed service for partner developers, with availability currently limited to certain regions and organisations.