Microsoft disrupts Fox Tempest malware attacking health care, other sectors 

Microsoft announced May 19 that it disrupted operations of Fox Tempest, a threat actor operating as a malware-signing-as-a-service used by cybercriminals to deploy malicious code, including ransomware. Microsoft said Fox Tempest has enabled attacks on a range of sectors in the U.S. and internationally, including health care, education, government and financial services. The actor has been linked to other ransomware groups, including INC, Qilin and Akira. 

“One component of modern security is that software packages need to be digitally signed to prove their authenticity,” said Scott Gee, AHA deputy national advisor for cybersecurity and risk. “Normally, these signatures can only be provided by trusted, verified sources. Fox Tempest provided these signatures to malware so that it appeared to be legitimate to security systems. This service enabled a number of ransomware actors to attack health care and other sectors. Microsoft has revoked over 1,000 certificates issued by Fox Tempest. Hospitals and health systems should ensure that certificate verification is enabled on their cybersecurity toolsets.” 
 
For more information on this or other cyber and risk issues, contact Gee at sgee@aha.org. For the latest cyber and risk resources and threat intelligence, visit aha.org/cybersecurity.