Microsoft details Austria-based malware group Knotweed, which has used Windows and Adobe zero-day exploits to attack European and Central American organizations
Reports seeing ‘offensive actor’ flinging SubZero malware — Microsoft has published an analysis of a Europe-based … Source: Microsoft Security Blog .
Microsoft's January reporting on destructive malware against Ukrainian organizations also shows the company publicly distinguishing campaigns by their operational behavior. Naming Knotweed and SubZero gives defenders a more specific actor-and-tool frame for assessing this activity.
First-order effects
European and Central American organizations targeted by Knotweed face exposure from SubZero activity delivered through both Windows and Adobe zero-day exploits.
Microsoft's disclosure separates Knotweed from the other actors in its tracking, while Windows and Adobe are directly implicated in the attack surface described.
Second-order effects
Security teams at affected organizations must assess Windows and Adobe exposure together rather than treating the campaign as a single-vendor vulnerability issue.
Microsoft and Adobe customers gain another reason to prioritize threat monitoring alongside patch management, because the reported exploits were used before their vulnerabilities were publicly known.
Third-order effects
The sequence of Microsoft coverage points to zero-day exploitation as a recurring tool across distinct espionage and destructive campaigns, making cross-vendor endpoint visibility more central to enterprise defense.
If actors continue combining malware with exploits across major desktop software, defensive advantage will increasingly depend on correlating vendor telemetry and actor intelligence rather than on product-specific controls alone.
The trend: Targeted intrusion groups are increasingly forcing defenders to treat zero-day risk as a cross-ecosystem intelligence problem rather than a vulnerability isolated to one platform.
Microsoft discovered and patched a 0-day exploit (CVE-2022-22047) that #KNOTWEED, an Austria-based private sector offensive actor, used to deploy #Subzero malware. Analysis of campaigns, tactics, & payloads in this #MSTIC blog w/ @msftsecresponse @RiskIQ: https://www.microsoft.co…
😮 Microsoft just pulled a sick burn on yet another European private company called DSIRF, from Austria, selling spyware named Subzero. Here's details on the 0day exploits and the implants they sell. #KNOTWEED https://www.microsoft.com/...
Continuing the fight against cyberweapons and surveillance is important. Today, we announced a disruption against a private sector actor we call KNOTWEED and filed testimony in support of the House Permanent Select Committee on Intelligence hearing. Info: https://blogs.microsoft.…
Microsoft provided Spyware Samples in their latest security brief....wow what a concept...upload the samples and write a technical document that can be studied by people around the world. @citizenlab you have a lot of explaining to do. #spyware https://www.microsoft.com/...
Microsoft said today that a surveillance vendor it has been tracking as Knotweed is “an Austrian-based PSOA named DSIRF that ostensibly sells general security and information analysis services to commercial customers” PSOA=private sector offensive actor https://blogs.microsoft.co…
Malware hunters at Microsoft have caught an Austrian hack-for-hire company exploiting Windows and Adobe 0days in “limited and targeted attacks” against European and Central American computer users Story: https://www.securityweek.com/ ...
And a technical blog post from the MSTIC team supporting the company's assessment that Knotweed=DSIRF https://www.microsoft.com/... https://twitter.com/...
KNOTWEED is Austria-based DFIR, called out by Microsoft as a mercenary exploit firm (PSOA - private sector offensive actor) https://twitter.com/... https://twitter.com/...