Microsoft seizes infrastructure tied to Fox Tempest malware signing service

Microsoft has disrupted a major cybercrime operation that provided a service allowing hackers to disguise malware as legitimate software, the company announced this week. The action, which included seizing infrastructure and filing a lawsuit, targeted a threat actor known as Fox Tempest.

The company's Digital Crimes Unit, in collaboration with law enforcement and industry partners, dismantled the group's infrastructure in May. Microsoft obtained a court order from the U.S. District Court for the Southern District of New York, enabling it to seize domains, disable hundreds of virtual machines, and take down approximately 1,000 fraudulent accounts. The group's primary website, signspace.cloud, was transferred to a Microsoft-controlled sinkhole.

Fox Tempest operated a "malware-signing-as-a-service" platform, which Microsoft calls an MSaaS offering. The service abused Microsoft's own Artifact Signing system, a tool designed to verify software authenticity, to create short-lived, fraudulent code-signing certificates. These certificates made malicious files appear trustworthy, allowing them to bypass security controls. Steven Masada, an assistant general counsel with Microsoft's...