Microsoft has disrupted the infrastructure powering the largest malware code-signing service used to help ransomware groups and other cybercriminals make malicious programs harder to detect on Windows. The threat actors behind the service used stolen identities and impersonated legitimate organizations to obtain more than 1,000 code-signing certificates.

Microsoft seized the group’s website, signspace[.]cloud, revoked the abused certificates, which were obtained through its Artifact Signing service, and took offline hundreds of virtual machines set up by the attackers on Azure. Cybercriminals paid between $5,000 and $9,000 to use the malware signing as a service (MSaaS), highlighting its effectiveness.

Microsoft’s researchers have established clear links between the group running this operation, which it calls Fox Tempest, and ransomware affiliates who worked with gangs such as INC, Qilin, Akira, and Rhysida.

One ransomware group tracked as Vanilla Tempest used the code-signing service to create malcious installers for common enterprise software, such as AnyDesk, Microsoft Teams, Putty, and Webex. These fake but digitally signed installers were distributed via SEO poisoning and malvertising and were used to deploy a variety of backdoors, infostealers, and ransomware programs.

“This case points to how cybercrime is changing,” Steven Masada, assistant general counsel with Microsoft’s Digital Crimes Unit, said in a blog post. “What once required a single group to carry out an attack from start to finish is now broken into a modular ecosystem where services are bought and sold and work interchangeably with one another. Some services are inexpensive and widely used. Others, like Fox Tempest, are highly specialized and expensive because they remove friction or bypass obstacles that make attacks fail, making them both more reliable and harder to detect.”

Code signing at scale

The value of digitally signing executable files is that Microsoft Defender SmartScreen will display weaker warnings for downloaded files, or no warning at all if the file has built up a clean reputation over time. For attacks that rely on users executing rogue installers that masquerade as popular applications, having no scary warnings is a big advantage.

For a digital signature to be valid, it needs to be created by a code-signing certificate that was issued by one of the trusted Certificate Authorities in the Windows Trust Store. Microsoft offers such a service under Azure called Artifact Signing through which developers can obtain short-lived certificates for their applications, but this process requires identity verification.

Fox Tempest likely used stolen identities to pass the verification process and created hundreds of Azure accounts and tenants for use in its operation. The group then built its service on top of these subscriptions and provided code-signing services to the cybercrime ecosystem since at least May 2025.

More recently the group started providing preconfigured VMs hosted on a VPS provider that enabled threat actors to upload malicious files directly and receive signed binaries in return.

“Illicit code-signing certificates have been sold and trafficked for more than a decade,” Masada said. “That includes its use by nation-state actors to target critical infrastructure organizations in Europe. What’s changed is how this activity is marketed, packaged, and sold as a service, along with the scale at which it is now used across ransomware campaigns. Instead of buying certificates one-by-one, criminals upload their malware to a service that signs it for them.”