[threat-actors] Add Fox Tempest

[Aryu-RU]

Adds Fox Tempest to clusters/threat-actor.json.

Fox Tempest (Microsoft naming) is a financially motivated actor that operated a malware-signing-as-a-service, abusing Microsoft Artifact Signing to issue fraudulent short-lived code-signing certificates for ransomware operators. Microsoft's Digital Crimes Unit disrupted the operation (signspace[.]cloud) in May 2026, revoking 1,000+ certificates and naming Vanilla Tempest as a co-defendant in the SDNY.

Entry

• value: Fox Tempest
• uuid: 56bc8e25-6915-4e2e-8d44-9d3b14aab9f6 — fresh v4; grep -r confirms unique across clusters/ and galaxies/

References (meta.refs)

• https://www.microsoft.com/en-us/security/blog/2026/05/19/exposing-fox-tempest-a-malware-signing-service-operation/ — Microsoft Security Blog (original naming + technical source)
• https://blogs.microsoft.com/on-the-issues/2026/05/19/disrupting-fox-tempest-a-cybercrime-service/ — Microsoft (disruption / legal action)
• https://therecord.media/microsoft-disrupts-fox-tempest-malware-signing-service — The Record / Recorded Future (independent corroboration)

Cross-vendor identity / dedup check
Microsoft is currently the only vendor to publicly name this actor; no cross-vendor aliases exist yet. Searched clusters/ case-insensitively for Fox Tempest, signspace, malware-signing, and MSaaS — no existing entry represents this actor under any name. The downstream actors it serviced (Vanilla Tempest, Storm-0501, Storm-2561, Storm-0249) already exist as separate entries and are consumers of the service, not this actor; they are named in the description rather than duplicated. No related links added, consistent with recent single-entry additions.

Housekeeping

• version bumped 341 → 342
• ./jq_all_the_things.sh applied; entry appended at end (insertion-order convention); jsonschema + chk_empty_strings pass.