Microsoft and Global Partners Disrupt 'Fox Tempest' Malware-Signing-as-a-Service Platform

Executive Summary

On May 21, 2026, Microsoft announced the successful disruption of a major cybercrime operation codenamed Fox Tempest. This group operated a highly effective Malware-Signing-as-a-Service (MSaaS) platform, signspace.cloud, which was a critical component in the cybercrime ecosystem. The platform enabled threat actors, including prominent ransomware gangs, to sign their malicious payloads with fraudulently obtained code-signing certificates, thereby evading antivirus and EDR detections. The coordinated takedown, involving the FBI and Europol, seized the service's infrastructure and is considered a significant blow to the operational capabilities of numerous criminal groups that relied on it to deploy malware against critical sectors like healthcare and education.

Threat Overview

The Fox Tempest operation provided a turnkey solution for cybercriminals seeking to add a layer of legitimacy to their malware. By signing malicious executables, actors could bypass common security controls that trust signed code. The service, active since at least May 2025, was linked to the distribution of notorious malware families, including the INC, Qilin, and Akira ransomware strains, as well as information stealers like Lumma Stealer and Vidar. The investigation revealed connections between Fox Tempest and another financially motivated group, Vanilla Tempest, indicating a complex, interconnected cybercrime economy. The victims of malware signed via signspace.cloud were global and included thousands of organizations, with a notable impact on critical infrastructure, hospitals, and schools.

Technical Analysis

The core of the Fox Tempest service was the abuse of trust associated with code-signing certificates. Threat actors would submit their unsigned malware payloads to the signspace.cloud platform. The platform would then use a pool of fraudulently acquired Authenticode certificates to sign the malware. This process automates the T1553.002 - Code Signing technique.

Key TTPs associated with actors using this service include:

• Initial Access: Often achieved through separate means such as phishing (T1566), exploitation of public-facing applications (T1190), or stolen credentials (T1078).
• Execution: The signed malware is executed on the target system. The valid digital signature helps the malware bypass security software and user scrutiny (T1204.001 - Malicious Link).
• Defense Evasion: The primary technique is T1553.002 - Code Signing. By appearing as legitimate software from a trusted publisher, the malware avoids detection by host-based security solutions that may automatically trust signed binaries.
• Impact: For ransomware groups like Rhysida, the final stage is data encryption for financial impact (T1486 - Data Encrypted for Impact).

The disruption involved seizing the signspace.cloud domain, taking hundreds of the operation's virtual machines offline, and blocking access to the platform's underlying code.

Impact Assessment

The Fox Tempest MSaaS platform significantly lowered the barrier to entry for conducting effective cyberattacks. It industrialized a key defense evasion tactic, making it available to a wide range of actors, from sophisticated ransomware groups to lower-tier criminals. The impact on victims was severe, leading to ransomware incidents, data theft, and operational disruption across critical sectors. The targeting of hospitals and schools demonstrates the indiscriminate and damaging nature of these attacks. The disruption of signspace.cloud is expected to have a short-to-medium term effect, forcing cybercriminals to find new methods for signing their malware or to proceed with unsigned, more easily detectable payloads. This will likely increase their operational costs and reduce the success rate of their initial execution attempts.

IOCs — Directly from Articles

No specific file hashes, IP addresses, or domains beyond signspace.cloud were mentioned in the source articles.

Cyber Observables — Hunting Hints

Security teams may want to hunt for the following patterns to detect activity related to the abuse of code-signing:

• Hunt for newly issued certificates: Search for executables in your environment signed by certificates that are very new (e.g., issued within the last 30-90 days) and have low reputation or are from unknown publishers.
• Monitor for anomalous signed processes: Look for processes that are signed but are performing suspicious actions, such as spawning cmd.exe or powershell.exe to run reconnaissance commands, or making network connections to unusual domains.
• Analyze code-signing subjects: Scrutinize the 'Subject' field of code-signing certificates. Fraudulently obtained certificates often use generic or misspelled company names. Create a baseline of common signers in your environment and alert on deviations.
• Check Certificate Revocation Lists (CRL): Ensure systems are configured to check for revoked certificates. While not foolproof, it can prevent the execution of malware signed by certificates that have been identified and revoked.

Detection & Response

• Endpoint Detection and Response (EDR): Configure EDR tools to alert on signed executables that exhibit malicious behaviors (e.g., file encryption, credential dumping, lateral movement). A valid signature should lower, not eliminate, suspicion. This aligns with D3FEND's Process Analysis (D3-PA).
• Application Allowlisting: Implement application control solutions, such as Windows AppLocker or third-party tools, to restrict execution to only known, trusted software. A strict policy would only allow software signed by a pre-approved list of publishers. This is a form of D3FEND's Executable Allowlisting (D3-EAL).
• Log Analysis: Collect and analyze logs related to process execution (e.g., Windows Event ID 4688) and code integrity (Event IDs 3033, 3034 in the CodeIntegrity/Operational log). Correlate these logs with network data to spot signed processes making suspicious outbound connections.

Mitigation

• Publisher-Based Execution Policies: Configure application control rules to block or alert on software signed by publishers not on an explicit allow list. This is a crucial step beyond simply trusting any valid signature. This is a form of D3FEND Application Configuration Hardening (D3-ACH).
• Certificate Pinning and Trust Store Management: Regularly audit the trusted root certificate store on endpoints and servers to remove any non-essential or untrusted root CAs.
• Threat Intelligence: Subscribe to threat intelligence feeds that provide data on fraudulent certificates and malicious signers. Use this data to proactively block known-bad executables and publishers.
• User Training: While less effective against signed malware, continuous security awareness training can help users question unexpected software, even if it appears legitimate.