Back Blogs.Microsoft

Exposing Fox Tempest: A malware

Blogs.Microsoft •Microsoft Threat Intelligence • May 19, 2026

Fox Tempest is a financially motivated threat actor operating a malware‑signing‑as‑a‑service (MSaaS) used by other cybercriminals, including Vanilla Tempest and Storm groups, to more effectively distribute malicious code, including ransomware.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Microsoft Disrupts Fox Tempest Malware-Signing Service for Ransomware Gangs On May 19, 2026, Microsoft disrupted Fox Tempest, a malware-signing-as-a-service (MSaaS) operation that provided over 1,000 fraudulent code-signing certificates to cybercriminals, enabling them to disguise malware as legitimate software. The operation, active since May 2025, abused Microsoft's Artifact Signing service, allowing ransomware groups like Rhysida and Vanilla Tempest to deploy malware undetected. Microsoft seized the signspace[.]cloud domain, revoked the certificates, and took down hundreds of virtual machines linked to the operation. The service facilitated attacks on various sectors, including healthcare and education, across multiple countries, including the US, France, and India. The disruption was part of a broader legal case filed in the US District Court for the Southern District of New York. Microsoft is collaborating with the FBI and Europol to identify the individuals behind Fox Tempest. 22 sources 71

Exposing Fox Tempest: A malware

The full story

Extracted Entities

Attack Types (2)

Malware (1)