Microsoft shut down the digital signature service that issued the certificate...

Microsoft shut down a digital signature service that issued bootleg certificates to malware after it found a ransomware group entanglement.

According to a report by The Hacker News website, Microsoft has been cracking down on a hacker group called Fox Tempest because the hacker group has adopted an infrastructure system for signing Artifact Signing System, a Microsoft system, to sign malware and ransomware (Ransomware or ransom malware) in the form Malware-Signing-as-a-Service (MSaaS) through the signspace [.] cloud. In this crackdown operation, Microsoft has shut down the Virutal Machine used in many hacker operations, including blocking access. Website hosting (Hosting) of such a group of hackers is done.

Fox Tempest's malware signing service is an implementation of the Artifact Signing System (formerly Azure Trusted Signing), which was originally created to make it even easier for developers to develop and distribute software. This mechanism can create a short-lived temporary certificate that lasts only 72 hours to sign malware, so that the malware can be trusted to install on the victim's machine. The service is not complicated. Just let the hackers who use the service upload malware files to the website, so that the hackers who use the service can use the malware file to assume the identity of famous software such as AnyDesk, Microsoft Teams, PuTTY, and Cisco Webex for a service fee of approximately US $5,000 (163,800 baht) to US $9,000 (294,772.50 baht).

The Microsoft Digital Crimes Unit cybercrime suppression team has revealed that the contraband activity of such hackers is involved in the spread of many malware, such as the infostealer type of malware, such as Oyster, Lumma Stealer, and Vidar Stealer, many other ransomware, such as INC, Qilin, BlackByte, and Akira, which has been associated with attacks on many industries - education, finance, government organizations, and health - in a variety of countries such as France, India, China, and the United States, most recently found to be associated with Rhysida ransomware. Of the Vanilla Tempest group, too.

# Trending # Lemon 8 Howtoo # lemon 8 diary # Microsoft # freedomhack