Microsoft Revokes 200 Fraudulent Certificates Utilized in Rhysida Ransomware Marketing campaign

Oct 17, 2025Ravie LakshmananMalware / Cybercrime

Microsoft on Thursday disclosed that it revoked greater than 200 certificates utilized by a menace actor it tracks as Vanilla Tempest to fraudulently signal malicious binaries in ransomware assaults.

The certificates had been “utilized in pretend Groups setup recordsdata to ship the Oyster backdoor and finally deploy Rhysida ransomware,” the Microsoft Risk Intelligence staff stated in a submit shared on X.

The tech large stated it disrupted the exercise earlier this month after it was detected in late September 2025. Along with revoking the certificates, its safety options have been up to date to flag the signatures related to the pretend setup recordsdata, Oyster backdoor, and Rhysida ransomware.

Vanilla Tempest (previously Storm-0832) is the title given to a financially motivated menace actor additionally known as Vice Society and Vice Spider that is assessed to be energetic since at the least July 2022, delivering varied ransomware strains equivalent to BlackCat, Quantum Locker, Zeppelin, and Rhysida over time.

Oyster (aka Broomstick and CleanUpLoader), however, is a backdoor that is usually distributed through trojanized installers for fashionable software program equivalent to Google Chrome and Microsoft Groups utilizing bogus web sites that customers come across when trying to find the packages on Google and Bing.

“On this marketing campaign, Vanilla Tempest used pretend MSTeamsSetup.exe recordsdata hosted on malicious domains mimicking Microsoft Groups, for instance, teams-download[.]buzz, teams-install[.]run, or teams-download[.]prime,” Microsoft stated. “Customers are seemingly directed to malicious obtain websites utilizing search engine marketing (website positioning) poisoning.”

To signal these installers and different post-compromise instruments, the menace actor is claimed to have used Trusted Signing, in addition to SSL[.]com, DigiCert, and GlobalSign code signing providers.

Particulars of the marketing campaign had been first disclosed by Blackpoint Cyber final month, highlighting how customers trying to find Groups on-line had been redirected to bogus obtain pages, the place they had been provided a malicious MSTeamsSetup.exe as a substitute of the official consumer.

“This exercise highlights the continued abuse of website positioning poisoning and malicious commercials to ship commodity backdoors below the guise of trusted software program,” the corporate stated. “Risk actors are exploiting consumer belief in search outcomes and well-known manufacturers to realize preliminary entry.”

To mitigate such dangers, it is suggested to obtain software program solely from verified sources and keep away from clicking on suspicious hyperlinks served through search engine advertisements.