Microsoft Revokes 200 Fraudulent Certificates Used in Rhysida Ransomware Campaign

Microsoft has disclosed that it revoked more than 200 certificates used by the threat actor it tracks as Vanilla Tempest to fraudulently sign malicious binaries in ransomware attacks, including those tied to Rhysida. The certificates were used in fake Teams setup files to deliver the Oyster backdoor and ultimately deploy Rhysida ransomware, according to Microsoft Threat Intelligence team.

The company said it disrupted the activity earlier this month after detection in late September 2025, and that its security solutions have been updated to flag signatures linked to the fake setup files, Oyster backdoor and Rhysida. Vanilla Tempest (formerly Storm-0832) is described as a financially motivated threat actor also called Vice Society and Vice Spider, active since at least July 2022 and responsible for multiple ransomware strains over the years. The campaign involved attackers signing installers with Trusted Signing and services from SSL, DigiCert, and GlobalSign to sign post‑compromise tools.