Microsoft Revokes 200 Fraudulent Certificates Used in Rhysida Ransomware Campaign
Source The Hacker News
Rated by Threat Radar
Data as of 24 Oct 2025, 01:00 UTC
What to do
AI-suggested
European organizations should enforce strict software procurement policies mandating downloads only from verified official sources such as Microsoft’s official website or authorized app stores. Implement advanced endpoint detection and response (EDR) solutions capable of detecting anomalous code signing certificates and unusual installer behaviors. Regularly audit and monitor certificate usage within the environment to detect any unauthorized or suspicious certificates. Enhance user awareness training focusing on the risks of downloading software from search engine results and recognizing signs of SEO poisoning. Employ DNS filtering and web proxy solutions to block access to known malicious domains mimicking legitimate software sites. Collaborate with threat intelligence providers to stay updated on indicators of compromise related to Vanilla Tempest and Rhysida ransomware. Utilize multi-factor authentication and network segmentation to limit lateral movement if initial compromise occurs. Finally, maintain robust, tested backup and recovery processes to mitigate the impact of ransomware attacks.
Description
Microsoft on Thursday disclosed that it revoked more than 200 certificates used by a threat actor it tracks as Vanilla Tempest to fraudulently sign malicious binaries in ransomware attacks. The certificates were "used in fake Teams setup files to deliver the Oyster backdoor and ultimately deploy Rhysida ransomware," the Microsoft Threat Intelligence team said in a post shared on X. The tech