Microsoft announced on Wednesday that it has disrupted a Vanilla Tempest campaign whose goal was the deployment of Rhysida ransomware.
Vanilla Tempest, also known as Vice Spider and Vice Society, has been around since at least 2021, mainly known for its ransomware attacks on the education and healthcare sectors.
Vice Society had its own leak website until 2023, disappearing at around the time when the notorious Rhysida ransomware emerged. The threat group has been known to deploy various file encryptors in its attacks, including BlackCat, Quantum Locker, and Zeppelin, but recently it has mainly used Rhysida ransomware.
Microsoft said it disrupted a Vanilla Tempest campaign in early October by revoking more than 200 certificates used by the cybercriminals to sign their malware.
According to the tech giant, the hackers signed fake Microsoft Teams setup files designed to install a backdoor named Oyster, which in turn would enable them to deploy Rhysida ransomware.
The fake Teams installers were delivered through websites hosted on domains such as ‘teams-download.buzz’ and ‘teams-install.run’. Victims were likely lured to these sites through SEO poisoning.
When victims ran the fake Teams setup files, they executed a loader that downloaded a signed version of the Oyster backdoor, which has been used by Vanilla Tempest since at least June 2025. The cybercriminals started signing the backdoor in early September.
“To fraudulently sign the fake installers and post-compromise tools, Vanilla Tempest was observed using Trusted Signing, as well as SSL[.]com, DigiCert, and GlobalSign code signing services,” Microsoft said.
Microsoft’s actions make the malware distributed by Vanilla Tempest easier to detect and block, and the immediate impact on the cybercrime operation may be significant, but the threat actors will likely re-arm with new certificates and slightly modified tactics.
Related: RaccoonO365 Phishing Service Disrupted, Leader Identified
Related: RapperBot Botnet Disrupted, American Administrator Indicted
Related: Recently Disrupted DanaBot Leaked Valuable Data for 3 Years
