Disruption of Vanilla Tempest’s Ransomware Campaign: What You Need to Know

Microsoft recently took action against a significant ransomware campaign orchestrated by a group known as Vanilla Tempest. This coordinated effort involved the use of fraudulent code-signing certificates to create malicious installers that mimicked Microsoft Teams. Here’s an in-depth look at the details of this operation, its implications, and the broader cybersecurity landscape.

Discovery and Action Taken by Microsoft

In October, Microsoft identified the high-volume campaign initiated by Vanilla Tempest, which is also recognized by aliases like VICE SPIDER and Vice Society. The company responded swiftly by revoking over 200 code-signing certificates, which the group had exploited to give a veneer of legitimacy to their malicious software. Microsoft’s Defender products now effectively detect these fraudulent installers, the Oyster backdoor, and the Rhysida ransomware utilized in their extortion efforts.

The initial detection stemmed from Microsoft telemetry, which first picked up on the malicious activity in late September 2025. Investigators observed that the nefarious actors had been hosting counterfeit versions of Microsoft Teams installers on domains closely resembling the authentic site—domains such as teams-download[.]buzz and teams-install[.]run. They used search-engine optimization techniques to increase the visibility of these fake installer pages to unsuspecting users.

How the Attack Was Executed

When users inadvertently downloaded a fraudulent installer labeled as MSTeamsSetup.exe, they unwittingly triggered a loader that deployed the Oyster backdoor. This backdoor allowed attackers to collect sensitive data, move laterally within networks, and ultimately deploy the Rhysida ransomware.

Security analysts noted that this attack chain was particularly concerning because it targeted the trust infrastructure. By leveraging legitimate certificate authorities like DigiCert and GlobalSign, attackers could sign fake installers, allowing them to pass through basic security checks and inadvertently convincing users to execute them.

Detection and Response

Microsoft’s security solutions managed to detect the fake setup files and monitor the malicious activities associated with the Oyster backdoor and Rhysida ransomware encryption. By revoking the compromised certificates and updating detection rules for their customers, Microsoft successfully mitigated some of the effects of this ambitious campaign.

The Role of Ransomware

Ransomware has been a key element of Vanilla Tempest’s operations. Cybersecurity researchers from Cyble trace the group’s activity back to at least June 2021. They have consistently targeted sectors like education, healthcare, and manufacturing—areas where the impacts of downtime and data theft can compel organizations to negotiate under pressure.

Recently, Vanilla Tempest intensified its operations using Rhysida ransomware, compounding their attacks with social engineering tactics that leveraged SEO poisoning and fraudulent code-signing. The methods employed follow a common pattern seen in modern ransomware attacks: compromise a trusted application, establish a hidden presence through a signed loader, escalate privileges, spread to other systems, and finally encrypt and exfiltrate data.

Recommended Security Practices

Microsoft has issued several recommendations for organizations to defend against similar threats. These include:

• Monitoring for unusual installer activity, particularly focusing on those invoking unsigned or atypical libraries.
• Keeping an eye on unexpected network connections to any unrecognized download domains.
• Investigating new service installations and scrutinizing process trees that trigger PowerShell commands with encoded lines.

Additional advice involves auditing for irregular certificate activities, such as new code-signing certificates from unknown entities or sudden changes in signers for frequently used installers.

Broader Trends in Cybersecurity

Research from Cyble has highlighted two crucial trends demonstrated by this operation. First, attackers are increasingly aiming to compromise the trust chain—this includes targeting certificates and vendor branding—since undermining trust can significantly ease the path for initial compromises. Second, it emphasizes the need for defenders to broaden their visibility beyond just network and endpoint telemetry. This expanded perspective should include analyzing supply-chain signals, such as certificate transparency logs and indicators of search-result poisoning.

As this incident illustrates, the battle against sophisticated cyber threats is ongoing, requiring constant vigilance and a proactive approach to security.