Signalis
sign in--:--:--UTC
Threat actors

Vanilla Tempest

☆ pin
Also known as Rapid Brigantine, Vice Society, Vice Spider, DEV-0832, INC Ransomware
Reports
7
First seen
Nov 1, 2025
Last seen
Jun 16, 2026
Motivation
Financial

Relationships

Co-mentioned with Vanilla Tempest in 3 Signalis reports (co-mention, not confirmed collaboration)×3foxtempestCo-mentioned with Vanilla Tempest in 1 Signalis report (co-mention, not confirmed collaboration)×1babadedaCo-mentioned with Vanilla Tempest in 1 Signalis report (co-mention, not confirmed collaboration)×1storm0494Reports targeting OtherOtherVanilla Tempest

Filled ◆ = CVE exploited in the wild. Entities that appear together in Signalis reporting — co-mention, not confirmed collaboration. Reports naming many actors at once (weekly roundups) are excluded from relationship edges.

Targeting

Sectors
Other ×5

Top ATT&CK techniques

T1486 Data Encrypted for Impact ×4T1566.002 Phishing: Spearphishing Link ×4T1027 Obfuscated Files or Information ×3T1190 Exploit Public-Facing Application ×2T1204 User Execution ×2T1140 Deobfuscate/Decode Files or Information ×2T1036.005 Match Legitimate Name or Location ×2T1036 Masquerading ×2T1566 Phishing ×2T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder ×2T1070.001 Indicator Removal: Clear Windows Event Logs ×2T1598 Phishing for Information ×2

Indicators

url ×65filename ×30hash_sha256 ×11ip_v4 ×8domain ×6cve ×3hash_sha1 ×2

Indicator values are available on Pro and via the API.

Associated CVEs

CVE-2021-26829 (exploited)CVE-2025-27915 (exploited)CVE-2025-41244 (exploited)

Recent reports

High

ClickFix Campaigns Expand Malware Delivery With New Loaders and Fake Update Lures

The Hacker NewsCritical

Microsoft Disrupts Fox Tempest Malware-Signing Service Used for Ransomware Distribution

The Hacker NewsCritical

Microsoft disrupts malware-signing-as-a-service operation abused by ransomware gangs

Bleeping ComputerCritical

Exposing Fox Tempest: A malware-signing service operation

Microsoft Threat IntelligenceHigh

Microsoft disrupts Fox Tempest code-signing service used by ransomware groups

CyberScoopCritical

Gootloader Threat Detection Overview – JavaScript Loader with WOFF2 Obfuscation

Huntress BlogHigh

Cyber Brief October 2025 – Espionage, Disruption, Data Breaches, and Supply Chain Threats

CERT-EU Threat Intel

This page shows data on a 7-day delay. Free accounts get the full delayed feed; real-time reports, indicators, and the API start at $29/mo.

Sign upSee plans