<p>Microsoft on Tuesday took actions against a “malware-signing-as-a-service” provider that has helped criminal hackers evade security defenses designed to check whether software is legitimate.</p>
Introduction to Malware Binary Triage (IMBT) Course
Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor.
Enroll Now and Save 10%: Coupon Code MWNEWS10
Note: Affiliate link – your enrollment helps support this platform at no extra cost to you.
<p>The group, dubbed Fox Tempest, was found to be abusing Microsoft code signing tools that validate whether software has been tampered with. Microsoft said it seized Fox Tempest’s website, took down hundreds of virtual machines running its operation and blocked access to another site that hosted underlying code used by the group.</p>
<p>Microsoft also unsealed a legal case in New York that targeted the group, and named another ransomware gang known as Vanilla Tempest as a co-conspirator.</p>
<p>Normally, software signing certificates are meant to prove a program is safe upon download and installation. Operations like Fox Tempest are often sought after in the cybercriminal world because they can be paid to bless hackers’ malware with a valid-looking signature to help it evade detection.</p>
<p>Fox Tempest has been operating its malware disguise services since May of last year, Microsoft said. The downstream impact of its operations — which have let other criminal hackers distribute ransomware and other malicious packages — “has resulted in attacks against a broad range of industry sectors, including healthcare, education, government, and financial services” in the U.S., France, India and China, the company said in an assessment of the group.</p>
<p>Hackers paid thousands of dollars to get their malicious code signed by Fox Tempest, with higher-paying plans receiving priority, the company added.</p>
<p>Illicit code-signing tools have been <a href=“Ask Fitis, the Bear: Real Crooks Sign Their Malware – Krebs on Security”>exchanged</a> for years, but “what’s changed is how this activity is marketed, packaged and sold as a service, along with the scale at which it is now used across ransomware campaigns,” Microsoft’s Digital Crimes Unit assistant general counsel Steven Masada said in a prepared statement.</p>
<p>“When attackers can make malicious software look legitimate, it undermines how people and systems decide what’s safe. Disrupting that capability is key to raising the cost of cybercrime,” he said. </p>
Article Link: Microsoft disrupts cybercrime service offering malware disguised as legitimate software - Nextgov/FCW