Microsoft Threat Intelligence has disrupted an active Rhysida ransomware campaign in which attackers weaponized Azure Trusted Signing certificates to distribute malware disguised as legitimate Microsoft Teams installers.
What Happened
According to Microsoft’s disclosure, the Vanilla Tempest threat group (also known as Vice Society) used fake Teams binaries — such as MSTeamsSetup.exe — hosted on domains like:
teams-download[.]buzzteams-install[.]runteams-download[.]top
Victims were tricked via SEO poisoning, directing them to these sites. Once downloaded, the files installed the “Oyster” backdoor instead of Microsoft Teams.
Oyster then enabled attackers to deliver Rhysida ransomware across victim networks.
How Certificates Were Abused
To evade detection, attackers digitally signed malware using more than 200 code-signing certificates, including some issued by Microsoft’s Azure Trusted Signing service.
- The certificates made the malicious binaries appear authentic and trusted.
- This allowed them to bypass endpoint security tools that flag unsigned software.
Microsoft has since revoked all 200+ certificates and disabled associated accounts.
Other certificate authorities mentioned — SSL.com, DigiCert, and GlobalSign — confirmed they are investigating potential misuse.
Who Is Behind It
The campaign is attributed to Vanilla Tempest, a group known for attacks on healthcare and education sectors.
- Previously deployed ransomware families: BlackCat, Rhysida
- Active since at least 2022, focusing on multi-stage intrusions and long-term persistence.
Security experts warn that the abuse of legitimate certificate infrastructures represents a growing supply-chain security risk, making malware nearly indistinguishable from authentic applications.
Microsoft’s Response
Microsoft has:
- Revoked Azure-issued certificates used in the attacks
- Coordinated internally to enhance Trusted Signing validation
- Issued alerts to impacted customers and security partners
The Bigger Picture
While Azure Trusted Signing is designed to help legitimate developers sign software securely, this incident underscores the dual-use risk of trust infrastructures.
Without continuous validation and behavioral analytics, even trusted certificates can be turned into weapons for deception.
Alcaeus Services Insight
This case demonstrates that trust itself can be exploited.
At Alcaeus Services, we help organizations strengthen their supply-chain and code-signing security, implementing:
- Certificate monitoring and revocation workflows
- Application signing audits
- Zero-trust software validation pipelines
