sign in--:--:--UTC

Fox Tempest

Reports

7

First seen

May 19

Last seen

Jun 8

Motivation

financial, financially motivated

Targeting

Sectors

other ×4

Top ATT&CK techniques

T1036 Masquerading ×3T1486 Data Encrypted for Impact ×3T1105 Ingress Tool Transfer ×3T1566 Phishing ×3T1195 Supply Chain Compromise ×3T1553.006 Code Signing ×2T1027 Obfuscated Files or Information ×2T1204 User Execution ×2T1566.002 Phishing: Spearphishing Link ×2T1036.005 Match Legitimate Name or Location ×2T1598.003 Spearphishing Link ×2T1598 Phishing for Information ×2

Indicators

cve ×36filename ×19hash_sha256 ×11domain ×9hash_sha1 ×3url ×1

Indicator values are available on Pro and via the API.

Associated CVEs

CVE-2018-5999 (exploited)CVE-2024-9643 (exploited)CVE-2026-20223 CVE-2026-41091 (exploited)CVE-2026-45498 (exploited)CVE-2026-45585 CVE-2026-46333 CVE-2026-9082 (exploited)

Recent reports

AI brands as bait: How threat actors use AI hype in social engineering campaigns

Microsoft Threat IntelligenceJun 8 Critical

Weekly Recap: Linux Flaws, Defender 0-Days, Router Botnets, and Supply Chain Chaos

The Hacker NewsMay 25 Critical

Microsoft Disrupts Fox Tempest Malware-Signing Service Used for Ransomware Distribution

The Hacker NewsMay 20 Critical

Microsoft disrupts malware-signing-as-a-service operation abused by ransomware gangs

Bleeping ComputerMay 19 Critical

Microsoft disrupts Fox Tempest malware-signing-as-a-service platform tied to ransomware gangs

The Record (Recorded Future News)May 19 Critical

Exposing Fox Tempest: A malware-signing service operation

Microsoft Threat IntelligenceMay 19 High

Microsoft disrupts Fox Tempest code-signing service used by ransomware groups

CyberScoopMay 19

This page shows data on a 7-day delay. Free accounts get the full delayed feed; real-time reports, indicators, and the API start at $29/mo.

Sign up See plans