Microsoft has announced the takedown of a significant code-signing operation used by ransomware gangs to evade detection and spread malware. The operation, which has been described as 'global in scope', targeted thousands of US victims, with estimates suggesting that over 12 machines owned and operated by Microsoft itself were compromised. The code-signing operation, which allowed malicious actors to sign their malware as legitimate, was used to spread ransomware and other types of malware.
The operation was taken down by Microsoft's Digital Crimes Unit, in collaboration with law enforcement agencies and other partners. The company has not disclosed the exact number of victims affected by the operation, but did confirm that it was 'in the thousands'.
The takedown is a significant blow to ransomware gangs, who have been using such operations to spread malware and extort money from unsuspecting victims. Ransomware attacks have been on the rise in recent years, with the UK's National Cyber Security Centre (NCSC) warning of a significant increase in attacks in the past 12 months.
The UK Government has been working to address the issue of ransomware, with the NCSC providing guidance and support to businesses and individuals affected by the attacks. The Government has also been working with international partners to disrupt and dismantle ransomware gangs.
Foreign Office travel advice has not been affected by the takedown, but the incident serves as a reminder of the importance of being vigilant when it comes to cybersecurity. UK businesses and individuals are advised to follow best practices for cybersecurity, including keeping software up to date and being cautious when opening emails or clicking on links.
Microsoft's actions demonstrate the company's commitment to combating cybercrime and protecting its customers. The takedown is a significant achievement, but it is likely that other code-signing operations will emerge in the future.