Fox Tempest

☆ pin

Reports

First seen

May 19, 2026

Last seen

Aug 10, 2026

Motivation

Financial

Relationships

Filled ◆ = CVE exploited in the wild. Entities that appear together in Signalis reporting — co-mention, not confirmed collaboration. Reports naming many actors at once (weekly roundups) are excluded from relationship edges.

Targeting

Sectors

Other ×4

Top ATT&CK techniques

T1566 Phishing ×4T1486 Data Encrypted for Impact ×4T1105 Ingress Tool Transfer ×3T1036 Masquerading ×3T1195 Supply Chain Compromise ×3T1553.006 Code Signing ×2T1027 Obfuscated Files or Information ×2T1036.005 Match Legitimate Name or Location ×2T1598.003 Spearphishing Link ×2T1566.002 Phishing: Spearphishing Link ×2T1219 Remote Access Software ×2T1204 User Execution ×2

Indicators

cve ×39filename ×19hash_sha256 ×11domain ×9hash_sha1 ×3url ×1

Indicator values are available on Pro and via the API.

Associated CVEs

CVE-2018-5999 (exploited)CVE-2024-9643 (exploited)CVE-2026-20223 CVE-2026-33825 (exploited)CVE-2026-41091 (exploited)CVE-2026-45498 (exploited)CVE-2026-45585 CVE-2026-46333 CVE-2026-50751 (exploited)CVE-2026-50752 CVE-2026-9082 (exploited)

Recent reports

High

Fox Tempest

Relationships

Targeting

Top ATT&CK techniques

Indicators

Associated CVEs

Recent reports

IT threat evolution in Q2 2026: Ransomware, miners, and vulnerability exploitation

AI brands as bait: How threat actors use AI hype in social engineering campaigns

Weekly Recap: Linux Flaws, Defender 0-Days, Router Botnets, and Supply Chain Chaos

Microsoft Disrupts Fox Tempest Malware-Signing Service Used for Ransomware Distribution

Microsoft disrupts malware-signing-as-a-service operation abused by ransomware gangs

Microsoft disrupts Fox Tempest malware-signing-as-a-service platform tied to ransomware gangs

Exposing Fox Tempest: A malware-signing service operation

Microsoft disrupts Fox Tempest code-signing service used by ransomware groups