Microsoft revokes 200 fraudulent certificates linked to ransomware

Microsoft just pulled the plug on over 200 fraudulent certificates that were being used by a group known as Vanilla Tempest to carry out ransomware attacks. These certificates were signed off on fake Microsoft Teams setup files, which were a sneaky way to deliver the Oyster backdoor and install Rhysida ransomware. The company caught wind of this shady operation in late September and took action earlier this month.

Vanilla Tempest, which has been around since at least July 2022, is linked to other notorious ransomware strains like BlackCat and Quantum Locker. By revoking these certificates, Microsoft is not just shutting down this specific attack vector but also updating its security tools to flag any malicious activity related to these fake setups. If you’re using Microsoft products, it’s a good reminder to stay vigilant and keep your systems updated.