Microsoft Disrupted Vanilla Tempest Attack by Revoking Certificates Used to Sign Fake Teams File

Revocation of Digital Certificates by Microsoft

On Thu, Oct 15, 2025, Microsoft revoked over 200 digital certificates exploited by the Vanilla Tempest hacking group. This measure effectively disrupted a campaign in which attackers impersonated Microsoft Teams installations to infiltrate corporate networks and deploy ransomware.

The operation, identified in late September, demonstrated the evolving tactics of ransomware operators using legitimate-looking software to bypass security defenses. Vanilla Tempest, also known as VICE SPIDER and Vice Society, has been a persistent threat in the ransomware landscape. The group specializes in data exfiltration for extortion, often combining theft with encryption attacks.

Vanilla Tempest has employed various ransomware strains over the years, including BlackCat, Quantum Locker, and Zeppelin. Recently, Rhysida ransomware has been their preferred tool, targeting sectors such as healthcare, education, and manufacturing for significant disruptions.

Distribution via Fake Microsoft Teams Downloads

The latest campaign targeted users seeking legitimate Microsoft Teams updates. Attackers hosted counterfeit installation files on domains like teams-download[.]buzz, teams-install[.]run, and teams-download[.]top. These sites likely gained visibility through search engine optimization (SEO) poisoning, diverting victims to malicious downloads.

Once executed, the fake installers deployed a multi-stage payload. An initial loader introduced the Oyster backdoor, a versatile malware tool used by Vanilla Tempest since June 2025. By early September, the group had fraudulently signed these backdoors and loaders with certificates from reputable providers like Trusted Signing, SSL.com, DigiCert, and GlobalSign, lending an air of authenticity that tricked antivirus software and user scrutiny.

Microsoft's response included certificate revocation and strengthening defenses through Microsoft Defender Antivirus, which now identifies and blocks fake setup files, the Oyster backdoor, and Rhysida ransomware variants. For enterprise users, Microsoft Defender for Endpoint offers behavioral detections tailored to Vanilla Tempest's tactics, techniques, and procedures, including anomalous network activity and privilege escalations.

The incident underscores the risks of supply chain-style attacks in software updates, as attackers exploit trust in familiar brands. Microsoft's proactive revocation prevented further abuse of compromised certificates, but similar tactics could re-emerge with new signing authorities.

Based on reporting by Cyber Security News.