Microsoft Disrupts Fox Tempest Malware-Signing-as-a-Service Platform

Microsoft unsealed a legal case in U.S. District Court detailing the disruption of Fox Tempest, a malware-signing-as-a-service platform that has operated since May 2025. Fox Tempest provided cybercriminals with code signing tools, allowing ransomware and other malware to masquerade as legitimately signed software and evade endpoint defenses. The service was popular among multiple ransomware gangs as a mechanism to increase delivery success rates. The legal action is a significant takedown of criminal infrastructure-as-a-service supporting the ransomware ecosystem.