Microsoft revokes 200+ certificates abused by Vanilla Tempest in fake Teams campaign

Microsoft revoked more than 200 certificates used by the Vanilla Tempest group to sign fake Teams installers that delivered the Oyster backdoor and Rhysida ransomware. The activity, active since July 2022, targeted organisations across education, healthcare, IT, and manufacturing, with RDP used for lateral movement and the INC ransomware payload deployed via the Windows Management Instrumentation Provider Host.

In early October 2025, Microsoft disrupted the campaign by revoking the fraudulent certificates and halting the distribution of fake Teams setup files designed to signeredly install the Oyster backdoor and later Rhysida ransomware, according to Microsoft.

The attackers hosted fraudulent MSTeamsSetup.exe installers on domains mimicking Microsoft Teams and lured victims through SEO poisoning to malicious download sites, with the attackers abusing Trusted Signing, SSL[.]com, DigiCert, and GlobalSign services to sign the binaries. Microsoft also added IoCs to Defender Antivirus to help detect the fake setup files, and Defender for Endpoint guidance was provided to mitigate and investigate the attack.