Microsoft Threat Intelligence has revoked over 200 certificates fraudulently signed by a threat actor and used in fake MS Teams set-up files to deliver a backdoor and malware.
The campaign, dubbed Vanilla Tempest by Microsoft and tracked as Vice Spider and Vice Society by others, was identified in late September.
The threat actor is financially motivated and focuses on deploying ransomware and exfiltrating data for extortion.
Fake Teams set-up files were used to deliver the Oyster backdoor and ultimately deploy Rhysida ransomware.
Alongside Rhysida, other ransomware variants including BlackCat, Quantum Locker, and Zeppelin have been used by the threat actor.
The campaign saw attackers leverage SEO poisoning and malvertising techniques to trick users into downloading fake MSTeamsSetup.exe files that deliver the Oyster backdoor.
Victims searching for “Teams download” would be lured to spoofed websites hosting the fake MS Teams installers. The malicious domains mimicking Microsoft Teams included teams-download[.]buzz, teams-install[.]run, or teams-download[.]top.
Microsoft said Vanilla Tempest incorporated Oyster into their attacks as early as June 2025. However, they started fraudulently signing these backdoors in early September 2025.
To fraudulently sign the fake installers and post-compromise tools, Vanilla Tempest was observed using Trusted Signing, as well as SSL[.]com, DigiCert, and GlobalSign code signing services.
The tech giant said that fully enabled Microsoft Defender Antivirus blocks this threat. In addition to detections, Microsoft Defender for Endpoint has additional guidance for mitigating and investigating this attack.
Vanilla Tempest has been highly active since at least 2021. Links between this group and Rhysida ransomware were made by security researchers in 2023 following a spate of incidents affecting the healthcare sector in the US.
In 2022, a series of ransomware campaigns conducted by Vanilla Tempest targeted the education sector in both the UK and US.
