Denim Tsunami (KNOTWEED, DSIRF) is a threat actor using Subzero malware in targeted attacks against European and Central American entities.
Analyst brief
Denim Tsunami (KNOTWEED, DSIRF) is a threat actor conducting targeted attacks against European and Central American entities. They use custom Subzero malware with keylogging, screenshot capture, data exfiltration, and remote shell capabilities. The actor has leveraged multiple Windows and Adobe 0-day exploits, including CVE-2022-22047 for privilege escalation. Defenders should monitor for Subzero malware indicators, suspicious privilege escalation attempts, and infrastructure linked to DSIRF.
Denim Tsunami
KNOTWEEDDSIRF
unknown
Denim Tsunami is a threat actor group that has been involved in targeted attacks against European and Central American customers. They have been observed using multiple Windows and Adobe 0-day exploits, including one for CVE-2022-22047, which is a privilege escalation vulnerability. Denim Tsunami developed a custom malware called Subzero, which has capabilities such as keylogging, capturing screenshots, data exfiltration, and running remote shells. They have also been associated with the Austrian spyware distributor DSIRF.