MicrosoftPublished
Disrupting Fox Tempest: A cybercrime service that turned “verified” software into a pathway for ransomware
By Steven Masada
Excerpt
Every day, we decide what software to trust in seconds guided by simple labels such as “verified,” “secure,” and “safe to install.” The problem is that those signs can be manipulated.
Today, Microsoft unsealed a legal case in the US District Court for the Southern District of New York targeting a cybercrime service known as Fox Tempest, which, since May 2025, has enabled cybercriminals to disguise malware as legitimate software. The malware-signing-as-a-service (MSaaS) worked by fraudulently accessing and…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Microsoft on blogs.microsoft.com.
Mentioned in the excerpt
More from Microsoft30
- dd252791.aspxMicrosoft · Added 19 Oct
- ms14-068.aspxMicrosoft · Added 19 Oct
- assocMicrosoft · Added 18 Oct
- The Gentlemen ransomware: Dissecting a self-propagating Go encryptorMicrosoft · Published 28 May
On the same topics
- Ragnar LoaderPRODAFT · Added 18 Oct
- Netwalker malware: What it is, how it works and how to prevent itInfosec Institute · Published 29 Jul 2020
- How CrowdStrike Analyzes macOS Malware to Optimize Automated DetectionCrowdStrike · Published 6 May 2022
- Microsoft disrupts Fox Tempest malware-signing-as-a-service platform tied to ransomware gangsThe Record · Published 19 May
