MalwarePublished 16 Oct 2025

Microsoft Revokes Over 200 Certificates to Disrupt Ransomware Campaign

Source SecurityWeek

Description

The tech giant attributed the attacks to Vanilla Tempest, also known as Vice Spider and Vice Society. The post Microsoft Revokes Over 200 Certificates to Disrupt Ransomware Campaign appeared first on SecurityWeek .

Impact

The revocation of over 200 certificates disrupts the ability of the Vanilla Tempest ransomware group to deploy signed malware, which could otherwise evade detection and execute with elevated trust. For European organizations, this reduces the immediate risk of ransomware infections signed with these certificates, potentially preventing operational downtime, data loss, and financial damage. However, the threat actor may adapt by acquiring new certificates or switching tactics, so the risk remains. Organizations heavily reliant on Microsoft platforms and software that trust these certificates are most impacted. Critical sectors such as finance, healthcare, government, and infrastructure in Europe could face targeted attacks, leading to data breaches, service interruptions, and reputational harm. The revocation also imposes operational challenges, as legitimate software signed with the revoked certificates may be affected, requiring careful validation and remediation. Overall, the action mitigates a significant attack vector but does not eliminate the ransomware threat posed by Vanilla Tempest.

Defensive guidance

1. Continuously monitor certificate revocation lists (CRLs) and implement automated alerts for the use of revoked or suspicious certificates within the network. 2. Employ endpoint detection and response (EDR) solutions capable of detecting and blocking execution of binaries signed with revoked or untrusted certificates. 3. Harden email and web gateways to detect and quarantine ransomware payloads, especially those attempting to leverage code signing for evasion. 4. Conduct regular threat hunting exercises focused on indicators of compromise related to Vanilla Tempest tactics, techniques, and procedures (TTPs). 5. Maintain up-to-date backups with offline or immutable storage to ensure recovery capability in case of ransomware infection. 6. Educate users on phishing and social engineering risks, as initial access often involves user interaction. 7. Review and restrict certificate issuance policies internally to prevent misuse and ensure rapid revocation processes. 8. Collaborate with Microsoft and security vendors to receive timely intelligence and updates regarding certificate revocations and emerging threats.

References

securityweek.com/microsoft-revokes-over-200-certificates-to-disrupt-ransomware-campaign/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 16 Oct 2025, 14:44 UTC

References

Community reviews