Microsoft has linked the Knotweed threat group to an Austrian spyware vendor that is currently targeting organizations in Europe and Central America with the “Subzero” malware toolkit. The Austrian spyware vendor is operating under the name “DSIRF” and promotes itself as providing “information research, forensics, and data-driven intelligence services to corporations.” Researchers identified multiple links between DSIRF and the development/attempted sale of Subzero, which is a malicious tool utilized by the Knotweed threat group. Post-compromise actions of attacks utilizing Subzero include credential dumping via “comsvcs.dll”, attempting to access emails from a Knotweed IP address, using Curl to download Knotweed tooling from public file shares, and “running PowerShell scripts directly from a GitHub gist created by an account associated with DSIRF”. RiskIQ researchers also analyzed the Knotweed command-and-control (C2) domain’s IP address and identified various additional domains with direct links to DSIRF, including the company’s primary website and several subdomains appearing to be used for malware development. Microsoft also added the typical tactics, techniques, and procedures (TTPs) of the Knotweed threat group to their report. This includes deploying “Corelump”, a primary payload, and “Jumplump”, a heavily obfuscated malware loader, in observed attacks utilizing the Subzero malware. Microsoft also explained the various capabilities of the primary Subzero payload to include capturing screenshots, keylogging, exfiltrating data, and running arbitrary plugins as well as remote shells. Microsoft researchers noted multiple zero-day vulnerabilities used in Knotweed campaigns, which now includes the recently patched Windows CSRSS elevation of privileges flaw tracked as CVE-2022-22047. Current victims of Knotweed include “law firms, banks, and strategic consultants in countries such as Austria, the United Kingdom, and Panama”, but CTIX analysts will provide an update if the threat group’s target scope evolves. An in-depth analysis of the linkage between Knotweed and DSIRF as well as indicators of compromise can be viewed in Microsoft’s report linked below.