Last week, Microsoft took legal and technical action to disrupt Fox Tempest, a cybercrime-as-a-service operation that enabled attackers to disguise malware as trusted software and scale ransomware attacks globally. The case highlights a growing shift toward service-based cybercrime ecosystems and the importance of targeting upstream tools that make attacks harder to detect.