Fox Tempest: The Dark Web Storefront That Sold Microsoft's Trust to Ransomware Gangs

This transcription is provided by artificial intelligence. We believe in technology but understand that even the smartest robots can sometimes get speech recognition wrong.

Fox Tempest: The Dark Web Storefront That Sold Microsoft's Trust to Ransomware Gangs

[00:00:02] Everyone, I'm Drax, and this is the 2-minute drill. It's great to see you today. Here's some stuff you might want to know about. You've seen the prompt a thousand times, a little shield icon. It says, "Do you want to allow this app from a verified publisher to make changes to your device?" And you click yes. The software was signed. It was checked by a trusted certificate authority. It was blessed by the operating system, given
[00:00:26] the digital equivalent of a background check. And that's the whole system. That's what keeps malware from running on Windows machines worldwide. But sometime in the spring of 2025, two people figured out how to sell that system to ransomware gangs. Court documents list them only as John Doe 1 and John Doe 2. They One of them used the handle Sam Code Sign, and they ran a
[00:00:53] service called Fox Tempest. And the product was really simple, code signing certificates that made malware look like legitimate software to Windows, clean, verified, and trusted.
[00:01:05] Their site had a menu that cybercriminals could choose from. Standard certificates for $5,000, priority turnaround for $7,500, expedited certificates were $9,500.
[00:01:17] They accepted Bitcoin as payment. They provided customers with virtual machine access and step-by-step instructions for signing their malware.
[00:01:28] And there was extensive customer service should the buyers need help. To get the certificates, Fox Tempest created more than 580 fraudulent Microsoft accounts using fake identities, impersonating real organizations. Those accounts let them obtain credentials through Microsoft's own artifact signing service. So, the certificates Windows saw as trusted,
[00:01:53] Microsoft actually issued them. Their signature was real. The system worked exactly as designed. It just had no idea it was being used against itself.
[00:02:05] The customers included some of the most active ransomware gangs running right now. Ryuk, Qilin, Ink, Fox Tempest malware infected thousands of machines across the United States, including more than a dozen owned by Microsoft, the company whose trust infrastructure was being sold to They were hit, too.
[00:02:29] Microsoft's digital crimes unit figured this out in early 2026 through undercover purchases, traced cryptocurrency wallets. They built the case over 2 months, and on May 19th, they shut it down. They took out all the infrastructure. And here's why this kind of past the headlines.
[00:02:49] Qilin is on that customer list, the same Qilin gang that hit Covenant Health in Maine in recent weeks, compromising nearly 480,000 patient records. And when you trace that ransomware back through the chain, the deployment, the lies, the trust layer that let it in, you may eventually land on a certificate, and that certificate probably had a real Microsoft signature on it bought from
[00:03:14] two people running a storefront on the criminal internet, the dark web. Every health system relies on code signing as a baseline trust signal.
[00:03:25] Your security tools flag unsigned software, and it waves through signed software. That's the architecture. That's actually how it all works. Fox Tempest didn't break the architecture, they monetized it. And they weren't alone. This kind of service exists because there's a steady demand for it.
[00:03:44] So, the question is, does your team know which vendors and tools in your environment are relying on code signing as a control? And now that you know that this market exists, what's your confidence that every signed application in your environment earned that signature That's it for today's 2-minute drill.
[00:04:05] Drop me a note and let me know what you're working on. I'm happy to hear from you. I'm drect@229project.com. Thanks for being here. Stay a little paranoid, and I will see you around campus.