Do Son Microsoft's DCU and Resecurity have disrupted Fox Tempest, a major MSaaS ring that forged code-signing certificates for ransomware delivery.
Vanilla Tempest
Gootloader returns with malformed ZIPs to bypass detection. New alliance with Vanilla Tempest fuels Rhysida ransomware attacks. See the detection tips.