Microsoft Revokes Over 200 Certificates to Disrupt Ransomware Campaign

Microsoft Revokes Over 200 Certificates to Disrupt Ransomware Campaign reported that Vanilla Tempest, also known as Vice Spider and Vice Society, was targeted. The campaign aimed to sign malware with fake Microsoft Teams installers to install a backdoor named Oyster, which would then deploy Rhysida ransomware. According to Microsoft, more than 200 certificates used by the group to sign their malware were revoked in early October, making the malicious software easier to detect and block.

The fake installers were hosted on domains such as teams-download[.]buzz and teams-install[.]run, and victims were likely drawn to these sites by SEO poisoning. The Oyster backdoor to which the backdoor loader connected has been used by Vanilla Tempest since at least June 2025, with signing beginning in early September, and the group reportedly relied on Trusted Signing as well as SSL[.]com, DigiCert, and GlobalSign services. The story was published on 16 October 2025.