Microsoft Halts Vanilla Tempest Cyberattack by Revoking Malicious Teams Installer Certificates

Microsoft has halted the Vanilla Tempest cyberattack by revoking over 200 fraudulent certificates that the threat group had used to sign fake Microsoft Teams installation files, which were designed to deliver the Oyster backdoor and deploy Rhysida ransomware on victims’ systems. Discovery occurred in late September 2025, after months of suspicious activity involving fraudulently signed binaries, with Microsoft stating Defender Antivirus can now detect the fake setup files, Oyster backdoor, and Rhysida ransomware.

According to Microsoft, the threat operates under the name Vanilla Tempest, also tracked by security vendors as VICE SPIDER and Vice Society, and has recently focused on deploying Rhysida ransomware. The campaign relied on social engineering and fraudulent signing through multiple trusted code signing services, including Microsoft’s Trusted Signing, SSL[.]com, DigiCert, and GlobalSign.

In a tweet quoted by the article, Microsoft Threat Intelligence described the actions taken and the threat’s signatures, emphasising that fully enabled Microsoft Defender Antivirus blocks the threat.