signspace[.]cloud

Microsoft on Tuesday said it disrupted a malware-signing-as-a-service (MSaaS) operation that weaponized the company's Artifact Signing system to deliver malicious code and conduct ransomware and other attacks, compromising thousands of machines and networks across the world. The tech giant attributed the activity to a threat actor it calls Fox Tempest, which it said offered the MSaaS scheme to allow cybercriminals to disguise malware as legitimate software. The threat actor has been active since May 2025. The seizure effort has been codenamed OpFauxSign. "To disrupt the service, we seized Fox Tempest's website signspace[.]cloud, took offline hundreds of the virtual machines running the operation, and blocked access to a site hosting the underlying code," Steven Masada, assistant general counsel at Microsoft's Digital Crimes Unit, said. Microsoft noted that the operation enabled the deployment of Rhysida ransomware by threat actors such as Vanilla Tempest, along with other malware families like Oyster, Lumma Stealer, and Vidar, illustrating the crucial role played by Fox Tempest within the cybercrime ecosystem. In addition, connections have been uncovered between the threat actor and affiliates associated with several prominent ransomware strains, including INC, Qilin, BlackByte, and Akira. Attacks mounted by these operations have targeted healthcare, education, government, and financial services located across the U.S., France, India, and China. Artifact Signing (formerly Azure Trusted Signing) is Microsoft's fully managed, end-to-end signing solution that allows developers to easily build and distribute applications, while ensuring that the software is legitimate and hasn't been modified by unauthorized parties. Fox Tempest is said to have leveraged this mechanism to generate short-lived, fraudulent code-signing certificates and use them to deliver trusted, signed malware and slip past security controls. The certificates were valid for only 72 hours. "To obtain legitimate signed certificates through Artifact Signing, the requestor must pass detailed identify validation processes in keeping with industry standard verifiable credentials (VC), which suggests the threat actor very likely used stolen identities based in the United States and Canada to masquerade as a legitimate entity and obtain the necessary digital credentials for signing," Microsoft explained. "The SignSpace website was built on Artifact Signing and enabled secure file signing through an admin panel and user page, leveraging Azure subscriptions, certificates, and a structured database for managing users and files." The service allowed paying cybercriminal customers to upload malicious files for code-signing using certificates fraudulently obtained by Fox Tempest. This, in turn, allowed malware and ransomware to masquerade as legitimate software like AnyDesk, Microsoft Teams, PuTTY, and Cisco Webex. The service cost between $5,000 and $9,000. Starting February 2026, the threat actor is said to have shifted to providing customers with pre-configured virtual machines (VMs) hosted on Cloudzy, thereby making it possible to directly upload the necessary artifacts to the attacker-controlled infrastructure and receive signed binaries in return. "This infrastructure evolution reduced friction for customers, improved operational security for Fox Tempest, and further streamlined the delivery of malicious but trusted, signed malware at scale," Microsoft said. Threat actors like Vanilla Tempest have been found to distribute binaries signed through the service via legitimately purchased advertisements that redirected users searching for Microsoft Teams to bogus download pages, paving the way for the deployment of Oyster (aka Broomstick or CleanUpLoader), a modular implant and loader that's responsible for delivering Rhysida ransomware. Microsoft said Fox Tempest has continually adapted its tradecraft as the company enacted countermeasures, such as disabling fraudulent accounts and revoking the illicitly obtained certificates, with the threat actor even attempting to shift to a different code-signing service. Court documents reveal that Microsoft worked with a "cooperative source" to purchase and test the service between February and March 2026. "When attackers can make malicious software look legitimate, it undermines how people and systems decide what's safe," Redmond said. "Disrupting that capability is key to raising the cost of cybercrime."

Microsoft says it has disrupted a malware-signing-as-a-service (MSaaS) operation that abused the company's Artifact Signing service to generate fraudulent code-signing certificates used by ransomware gangs and other cybercriminals. According to a report published today by Microsoft Threat Intelligence, the threat actor tracked as Fox Tempest used the Microsoft Artifact Signing platform to create short-lived certificates that allowed malware to be digitally signed and trusted as legitimate software by both users and operating systems. Azure Artifact Signing (previously Trusted Signing) is a cloud-based service launched by Microsoft in 2024 that allows developers to easily have their programs signed by Microsoft. Microsoft says the financially motivated threat actor created more than 1,000 certificates and hundreds of Azure tenants and subscriptions as part of the operation. Today, Microsoft also unsealed a legal case in the U.S. District Court for the Southern District of New York targeting the cybercrime operation. "Fox Tempest has created over a thousand certificates and established hundreds of Azure tenants and subscriptions to support its operations. Microsoft has revoked over one thousand code signing certificates attributed to Fox Tempest," Microsoft said. "In May 2026, Microsoft's Digital Crimes Unit (DCU), with support from industry partners, disrupted Fox Tempest's MSaaS offering, targeting the infrastructure and access model that enables its broader criminal use." Microsoft says it seized the signspace[.]cloud domain used by the service, took hundreds of virtual machines tied to the operation offline, and blocked access to infrastructure hosting the cybercrime platform. The site now redirects visitors to a Microsoft-operated site that explains that the company seized the domain as part of a lawsuit against the malware-signing-as-a-service scheme. The operation was linked to numerous malware and ransomware campaigns involving Oyster, Lumma Stealer, Vidar, as well as the Rhysida, Akira, INC, Qilin, and BlackByte ransomware operations. Microsoft says threat actors, including Vanilla Tempest (INC Ransomware members), Storm-0501, Storm-2561, and Storm-0249, used the signed malware in their attacks. Microsoft also named the Vanilla Tempest ransomware operation as a co-conspirator in the legal action, stating that the group used the service to distribute malware and ransomware in attacks targeting organizations worldwide. Microsoft says the MaaS was operated through signspace[.]cloud and allowed cybercriminal customers to upload malicious files for code-signing using fraudulently obtained certificates. These signed malware files were then used by threat actors to impersonate legitimate software such as Microsoft Teams, AnyDesk, PuTTY, and Webex, and were used to add legitimacy to the downloads. "When unsuspecting victims executed the falsely named Microsoft Teams installer files, those files delivered a malicious loader, which in turn installed the fraudulently signed Oyster malware and ultimately deployed Rhysida ransomware," reads Microsoft's complaint. "Because the Oyster malware was signed by a certificate from Microsoft's Artifact Signing service, the Windows operating system initially recognized the malware as legitimate software, when it would otherwise be flagged as suspicious or blocked entirely by security controls in the Windows operating system." Microsoft believes the operators likely used stolen identities from the United States and Canada to pass Artifact Signing identity verification requirements and obtain the signing credentials. When obtaining certificates, the threat actors reportedly used only short-lived certificates valid for 72 hours to reduce the risk of detection. BleepingComputer previously reported in March 2025 on threat actors abusing Microsoft's Trusted Signing service to sign malware used in a Crazy Evil Traffers crypto-theft campaign [VirusTotal] and a Lumma Stealer [VirusTotal] campaign. While those malware were also signed with 3-day certificates, it is unclear if they were signed by the Fox Tempest cybercrime platform. Microsoft also detailed how Fox Tempest evolved its operation earlier this year by providing customers with pre-configured virtual machines hosted through Cloudzy infrastructure. Customers uploaded malware to the VM environments and received signed binaries using Fox Tempest-controlled certificates. The malware-signing platform was promoted on a Telegram channel named "EV Certs for Sale by SamCodeSign," with pricing ranging from $5,000 to $9,000 in bitcoin for access to the platform. Microsoft says the operation generated millions of dollars in profits and is a well-resourced group capable of managing infrastructure, customer relations, and financial transactions. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Microsoft has cracked down on Fox Tempest, a cyber threat actor that fueled Rhysida ransomware attacks and developed tools for major malware strains like Oyster, Lumma Stealer, and Vidar. On May 19, the tech giant unsealed a legal case in the US District Court for the Southern District of New York focused on the group. It also shared details of how its Digital Crimes Unit (DCU) agents have engaged with Fox Tempest’s operators using undercover personas, identified the group’s infrastructure, collaborated with some of the organizations hosting this infrastructure and disrupted the group’s operations. Microsoft is now working with the FBI and Europol’s European Cybercrime Centre (EC3) to uncover the identity of people behind the group. Fox Tempest: A Prolific Cybercrime-Enabling Group Fox Tempest is a financially motivated threat actor that has been active since at least May 2025. The group operates “in the upstream in the malware and ransomware supply chain, as an enabler,” Maurice Mason, principal cybercrime investigator at Microsoft's Digital Crimes Unit, explained during a press briefing held on May 18. This means that, instead of carrying out malicious operations themselves, Fox Tempest provides tools and services enabling other cyber-threat actors to do so. Specifically, the group sells what Microsoft calls a “malware-signing-as-a-service” (MSaaS) offering that further allows cybercriminals to disguise malware as legitimate software and thereby evade traditional security defenses. Microsoft assessed that Fox Tempest has worked closely with several ransomware groups. These include Storm-2501, Storm-0249 and Rhysida, a group tracked by Microsoft as Vanilla Tempest. Rhysida, in particular, was named as a Fox Tempest’s co-conspirator in the lawsuit. The group has been linked to multiple cyber-attacks between 2023 and April 2026, including schools, hospitals, medical institutions and other critical infrastructure organizations worldwide. Rhysida is also believed to be behind an October 2023 hack targeting the British Library and a data extortion attack against Seattle-Tacoma International Airport in September 2024. Additionally, the fraudulent code-signing tool developed by Fox Tempest was identified by Microsoft in the deployment of a number of malware strains including Aurora, Lumma Stealer, Malcert, Oyster, Vidar and many more. It was also spotted in some campaigns deployed by MuddyWater, a cyber-espionage group attributed by several experts to Iran's Ministry of Intelligence and Security (MOIS). Among the countries most targeted by Fox Tempest were the US, France and India, followed by China, Brazil, Germany, Japan, the UK, Italy and Spain. “This doesn’t mean that these countries were targeted by malware or ransomware, but that there was a file on a machine in one of these countries that had been signed by a certificate made using the Fox Tempest-made code-signing service,” noted DCU’s Mason. Fox Tempest’s Code-Signing Abuse Explained To build its MSaaS tool, Fox Tempest abused code-signing tools such as Microsoft’s Artifact Signing, a system introduced as Trusted Signing in 2024 and designed to help software developers verify that software is legitimate and hasn’t been tampered with. “This fraudulent code-signing acts as a fake ID that lets cybercriminals get into the systems by walking right through the front door,” Steven Masada, global head of Microsoft DCU, explained. “It’s so scalable and easy for anyone to use, even for the most non-technical person. You just need to drag and drop a file into a portal and it gets your software signed with Afrtifact Signing.” After engaging with SamCodeSign, a seller of code-signing certificates since at least 2020 who acted as an access broker for Fox Tempest, the DCU team observed that they typically sell their service under three options: Standard version with purchase queue at $5000 Priority sale at $7500 Expedited sale at $9500 Microsoft also collaborated with cybersecurity company Resecurity to explore how Fox Tempest operates. Microsoft Takedown of Fox Tempest Infrastructure The DCU then investigated Fox Tempest’s infrastructure, which initially included a website called Signspace[dot]cloud, using legitimate hosting providers like UK-based Freak Hosting, and Estonia-based Wavecom as the service’s virtual private server (VPS) suppliers. The DCU team shifted its infrastructure in January 2026 and started using Cloudzy, another legitimate VPS provider based in Dubai, in the United Arab Emirates. On May 5, Microsoft filed a civil court action with the Court for the Southern District of New York and was granted a court order three days later. The DCU transferred the groups’ malicious domains to a Microsoft-owned sinkhole, disabled hundreds of virtual machines hosted on Cloudzy with the help of the provider, took down approximately 1000 accounts, and suspended the threat actor’s repository. The DCU team then engaged with SamCodeSign, which shared the issues it was experiencing operating the service. “He’s freaking out, he’s upset, he won’t sell us a certificate anymore,” said DCU’s Mason. Microsoft also observed a significant decrease in Fox Tempest-made certificates. “Every day, we decide what software to trust in seconds guided by simple labels such as ‘verified,’ ‘secure’ and ‘safe to install.’ The problem is that those signs can be manipulated,” said Masada. “For the first time, Microsoft is taking public action against a powerful, but often unseen, enabler within the cybercrime ecosystem, targeting how cybercriminals prepare and employ techniques to optimize their rate of success.” Image credit: gguy / Shutterstock.com