Microsoft targets Fox Tempest’s malware-signing service

Microsoft unsealed a US legal case against Fox Tempest on 19 May, targeting a service it said supplied fraudulent code-signing capability to cybercriminals. The announcement describes abuse of tools including Microsoft Artifact Signing to present malware as legitimate software.

The company said it seized the service’s website, took hundreds of supporting virtual machines offline and blocked access to a site hosting its underlying code. Microsoft also revoked fraudulently obtained certificates and removed accounts associated with the abuse.

According to Microsoft, operators impersonated legitimate organisations to obtain signing credentials, then sold access to customers distributing malware and ransomware. The lawsuit also named Vanilla Tempest as a co-conspirator; that is Microsoft’s allegation in a civil case.

The company said Fox Tempest had already attempted to move customers to another signing service as disruption efforts progressed. The action therefore limited one provider’s infrastructure while leaving a continuing response problem for the wider code-signing ecosystem. Microsoft described continued collaboration with the FBI.