Microsoft Disrupts Major Malware-Signing Network, Crippling Ransomware Operations
Cybercriminals are increasingly outsourcing malware distribution to specialized underground services, spending between $5,000 and $9,000 to keep ransomware and other malicious software undetected on Windows systems. This shift reflects the growing professionalization of cybercrime, with hackers relying on "malware signing as a service" (MSaaS) providers to bypass security measures rather than developing their own evasion techniques.
A key player in this ecosystem, Fox Tempest, was recently dismantled by Microsoft’s threat intelligence teams in a significant crackdown. The group had been supplying digitally signed malware to multiple ransomware gangs, including INC Ransom, Qilin, Akira, and Rhysida, allowing their payloads to evade antivirus detection by appearing as trusted software. Microsoft’s operation revoked fraudulently obtained digital certificates and shut down a network of Azure-hosted virtual machines that formed the backbone of the malware-signing infrastructure.
Investigations revealed that Fox Tempest operatives had been exploiting stolen identities and compromised tenant credentials since May 2025 to create hundreds of Azure accounts, which were used to anonymously host malicious infrastructure. The takedown is expected to disrupt the operations of several ransomware groups that relied on the service.
The incident underscores the business-like evolution of cybercrime, with underground markets offering specialized services to streamline attacks. The rise of MSaaS in Europe and beyond signals a dangerous new phase in ransomware campaigns, where criminals leverage third-party providers to scale their operations efficiently.
QILIN cybersecurity rating report: https://www.rankiteo.com/company/qilin
"id": "QIL1779265598",
"linkid": "qilin",
"type": "Ransomware",
"date": "5/2025",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'customers_affected': 'Ransomware gangs (INC Ransom, '
'Qilin, Akira, Rhysida) and '
'their victims',
'industry': 'Cloud Computing / Cybersecurity',
'location': 'Global (HQ: Redmond, USA)',
'name': 'Microsoft',
'size': 'Enterprise',
'type': 'Technology Company'},
{'industry': 'Cybercrime',
'location': 'Global',
'name': 'INC Ransom',
'type': 'Ransomware Gang'},
{'industry': 'Cybercrime',
'location': 'Global',
'name': 'Qilin',
'type': 'Ransomware Gang'},
{'industry': 'Cybercrime',
'location': 'Global',
'name': 'Akira',
'type': 'Ransomware Gang'},
{'industry': 'Cybercrime',
'location': 'Global',
'name': 'Rhysida',
'type': 'Ransomware Gang'}],
'attack_vector': 'Malware Signing as a Service (MSaaS), Stolen Identities, '
'Compromised Tenant Credentials, Azure-Hosted Virtual '
'Machines',
'customer_advisories': 'Users of Microsoft Azure should review account '
'security settings and enable multi-factor '
'authentication (MFA) to prevent unauthorized access.',
'data_breach': {'personally_identifiable_information': 'Yes (stolen '
'identities)',
'sensitivity_of_data': 'High (used for Azure account creation '
'and malware signing)',
'type_of_data_compromised': 'Stolen identities, Compromised '
'tenant credentials'},
'date_detected': '2025-05',
'description': 'Microsoft’s threat intelligence teams dismantled Fox Tempest, '
"a 'malware signing as a service' (MSaaS) provider that "
'supplied digitally signed malware to multiple ransomware '
'gangs, including INC Ransom, Qilin, Akira, and Rhysida. The '
'operation revoked fraudulently obtained digital certificates '
'and shut down a network of Azure-hosted virtual machines used '
'for malware-signing infrastructure. The group exploited '
'stolen identities and compromised tenant credentials since '
'May 2025 to create hundreds of Azure accounts for malicious '
'activities.',
'impact': {'brand_reputation_impact': 'Potential reputational damage to '
'Microsoft (Azure abuse)',
'identity_theft_risk': 'High (stolen identities used for Azure '
'account creation)',
'operational_impact': 'Disruption of ransomware operations for INC '
'Ransom, Qilin, Akira, and Rhysida',
'systems_affected': 'Azure-hosted virtual machines, Windows '
'systems with signed malware'},
'initial_access_broker': {'backdoors_established': 'Azure accounts used for '
'malware-signing '
'infrastructure',
'entry_point': 'Stolen identities and compromised '
'tenant credentials',
'high_value_targets': 'Ransomware gangs (INC '
'Ransom, Qilin, Akira, '
'Rhysida)'},
'investigation_status': 'Ongoing (disruption achieved, but full investigation '
'may continue)',
'lessons_learned': 'The professionalization of cybercrime through specialized '
'services like MSaaS poses significant threats. '
'Organizations must enhance identity and credential '
'security, particularly for cloud services like Azure, to '
'prevent abuse by threat actors.',
'motivation': 'Financial gain (service monetization for ransomware gangs)',
'post_incident_analysis': {'corrective_actions': ['Revocation of fraudulent '
'certificates',
'Shutdown of malicious '
'Azure VMs',
'Enhanced monitoring for '
'identity and credential '
'abuse'],
'root_causes': ['Exploitation of stolen identities '
'and compromised tenant '
'credentials',
'Abuse of Azure-hosted virtual '
'machines for malicious '
'infrastructure',
'Fraudulent digital certificate '
'issuance']},
'recommendations': ['Implement stricter identity verification for cloud '
'service accounts.',
'Monitor for fraudulent digital certificate usage.',
'Enhance detection of compromised tenant credentials.',
'Collaborate with cloud providers to disrupt malicious '
'infrastructure.',
'Raise awareness about the risks of MSaaS in ransomware '
'operations.'],
'references': [{'source': 'Microsoft Threat Intelligence'}],
'response': {'containment_measures': 'Revocation of fraudulently obtained '
'digital certificates, Shutdown of '
'Azure-hosted virtual machines',
'incident_response_plan_activated': 'Yes (Microsoft Threat '
'Intelligence)'},
'stakeholder_advisories': 'Cloud service providers should audit tenant '
'credentials and digital certificate issuance '
'processes. Enterprises should monitor for signs of '
'malware signed with fraudulent certificates.',
'threat_actor': 'Fox Tempest',
'title': 'Microsoft Disrupts Major Malware-Signing Network, Crippling '
'Ransomware Operations',
'type': 'Malware Distribution / Ransomware Enablement',
'vulnerability_exploited': 'Fraudulently obtained digital certificates, Lack '
'of Azure tenant credential security'}