Microsoft Revokes Over 200 Certificates to Disrupt Ransomware Campaign

[Brownie2019]

Content source

https://www.securityweek.com/microsoft-revokes-over-200-certificates-to-disrupt-ransomware-campaign/

Microsoft announced on Wednesday that it has disrupted a Vanilla Tempest campaign whose goal was the deployment of Rhysida ransomware.
Vanilla Tempest, also known as Vice Spider and Vice Society, has been around since at least 2021, mainly known for its ransomware attacks on the education and healthcare sectors.

Vice Society had its own leak website until 2023, disappearing at around the time when the notorious Rhysida ransomware emerged. The threat group has been known to deploy various file encryptors in its attacks, including BlackCat, Quantum Locker, and Zeppelin, but recently it has mainly used Rhysida ransomware.

Microsoft said it disrupted a Vanilla Tempest campaign in early October by revoking more than 200 certificates used by the cybercriminals to sign their malware.
According to the tech giant, the hackers signed fake Microsoft Teams setup files designed to install a backdoor named Oyster, which in turn would enable them to deploy Rhysida ransomware.
The fake Teams installers were delivered through websites hosted on domains such as ‘teams-download.buzz’ and ‘teams-install.run’. Victims were likely lured to these sites through SEO poisoning.

When victims ran the fake Teams setup files, they executed a loader that downloaded a signed version of the Oyster backdoor, which has been used by Vanilla Tempest since at least June 2025. The cybercriminals started signing the backdoor in early September.
“To fraudulently sign the fake installers and post-compromise tools, Vanilla Tempest was observed using Trusted Signing, as well as SSL[.]com, DigiCert, and GlobalSign code signing services,” Microsoft said.
Microsoft’s actions make the malware distributed by Vanilla Tempest easier to detect and block, and the immediate impact on the cybercrime operation may be significant, but the threat actors will likely re-arm with new certificates and slightly modified tactics.

 

[Bot]

Thanks for sharing this update, Brownie2019. It's always good to see Microsoft taking proactive steps against groups like Vanilla Tempest—revoking those certificates is a solid move to disrupt their operations, even if it's temporary. These actors have been a persistent thorn in sectors like education and healthcare, so any setback for them is a win.

For anyone reading this, it's a reminder to be extra vigilant with downloads, especially if they're mimicking legit apps like Teams. Stick to official sources, enable multi-factor authentication where possible, and keep your endpoint protection up to date. If you've encountered suspicious installers recently, running a scan couldn't hurt.

What do you think—will this push Vanilla Tempest to pivot to new TTPs quickly?