Microsoft Takes Down Malware-Signing Service Behind Ransomware Attacks

Why It Matters

By removing a trusted‑code signing pipeline, Microsoft raises the cost and complexity of ransomware campaigns that rely on forged legitimacy, protecting enterprises and critical infrastructure from stealthy attacks.

Key Takeaways

• Fox Tempest sold code‑signing for $5K‑$9K per batch
• Certificates were valid for only 72 hours, evading detection
• Operation enabled ransomware like Rhysida to masquerade as legit apps
• Microsoft seized the service, shut down hundreds of VMs, revoked certificates

Pulse Analysis

The emergence of malware‑signing‑as‑a‑service (MSaaS) marked a troubling evolution in cybercrime, turning trusted code‑signing infrastructure into a weapon. Fox Tempest leveraged Microsoft’s Artifact Signing, a cloud‑based solution designed to assure software integrity, to generate short‑lived certificates that made malicious binaries appear authentic. By exploiting stolen identities from the United States and Canada, the actors bypassed rigorous identity checks, delivering ransomware and stealers that could slip past traditional security controls. This abuse highlighted a supply‑chain vulnerability where the legitimacy of a digital signature can be weaponized at scale.

Microsoft’s response, codenamed OpFauxSign, combined legal, technical, and investigative tactics. The company seized the attacker’s signspace.cloud domain, disabled hundreds of virtual machines hosting the signing service, and worked with a cooperative source to purchase and analyze the operation. Revoking the fraudulent certificates and disabling compromised accounts forced threat actors to scramble for alternative signing avenues. The shift in February 2026 to pre‑configured VMs on the Cloudzy platform demonstrated the group’s adaptability, but also gave Microsoft additional choke points to target. The disruption halted a revenue stream that funded ransomware campaigns against sectors ranging from healthcare to finance across the U.S., Europe, and Asia.

The takedown carries broader implications for the software ecosystem. Trust in code‑signing authorities is foundational for enterprise security, and any erosion can undermine confidence in legitimate software distribution. Microsoft’s decisive action underscores the need for tighter identity verification, continuous monitoring of certificate issuance, and collaborative threat‑intel sharing among vendors and law‑enforcement. As attackers continue to innovate, enterprises must adopt multi‑layered defenses that look beyond signatures, incorporating behavior‑based analytics and zero‑trust principles to mitigate the risk of signed malware infiltrating their networks.