Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
8 IOCs
Exposing Fox Tempest: A malware-signing service operation
Threat Actors
Malware Families
Excerpt
In this article Fox Tempest’s role and impact Fox Tempest’s malware signing as a service infrastructure Defending against Fox Tempest-enabled attacks Microsoft Defender detections Indicators of compromise Fox Tempest is a financially motivated threat actor that operates a malware-signing-as-a-service (MSaaS) used by other cybercriminals to more effectively distribute malicious code, including ransomware. The threat actor abuses Microsoft Artifact Signing to generate…
Read the original report →Diamond Model
Adversary(2)
Infrastructure(1)
Capability(4)
Victim
Indicators of Compromise
Open the mindmap →8 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA1 | dc0acb01e3086ea8a9cb144a5f97810d291020ce | Medium | Score 53/100 | First seen |
| MD5 | 72f988bf86f141af91ab2d7cd011db47 | Medium | Score 53/100 | First seen |
| SHA256 | 11af4566539ad3224e968194c7a9ad7b596460d8f6e423fc62d1ea5fc0724326 | Medium | Score 53/100 | First seen |
| Domain | signspace.cloud | High | Score 64/100 | First seen |
| SHA256 | f0a6b89ec7eee83274cd484cea526b970a3ef28038799b0a5774bb33c5793b55 | Medium | Score 53/100 | First seen |
| MD5 | 870aef541453461c0a7208deb5fe4ca0 | Medium | Score 53/100 | First seen |
| SHA1 | 7e6d9dac619c04ae1b3c8c0906123e752ed66d63 | Medium | Score 53/100 | First seen |
| SHA256 | f0668ce925f36ff7f3359b0ea47e3fa243af13cd6ad9661dfccc9ff79fb4f1cc | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…