Microsoft exposes tactics of European mercenary spyware broker

guest · Jul 28, 2022

Microsoft Catches Austrian Company Exploiting Windows, Adobe Zero-Days
July 27, 2022

As a Congressional hearing meets Wednesday to discuss private contractors selling espionage spyware, and Reuters issued new reports such spyware was used to target the European Union's central lawmaking body, Microsoft is releasing details of a new campaign from an emerging contractor in the field.

"The NSO Group is the canonical example, but there are other companies included on the US Department of Commerce Entities List and a myriad of others that are selling these services that are not yet included on the List," Microsoft's Cristin Flynn Goodwin said in written testimony to the hearing.
Click to expand...

The new threat detailed by Microsoft in a blog post Wednesday is Austrian contractor DSIRF. DSIRF has marketed itself in the past as a threat intelligence operation with "highly sophisticated techniques in gathering and analysing information, to support the decision-making" of a tech, retail, financial and energy clientele. In practice, the company has been linked to sales of espionage malware, with media reports the group has marketed its "Subzero" malware to the Kremlin.
Click to expand...

Microsoft tracks and investigates mercenary espionage actors nicknames using nicknames taken from plants. It has been referring to DSIRF as "KNOTWEED."

Subzero appears to be distributed through a number of vectors, including vulnerabilities in Adobe and Windows products. Microsoft said it had patched at least four zero days being used by the group since 2021, with at least one zero day in Adobe used widely by the group. In one case, a malicious DLL loaded in through a chain of zero days, was actually signed to DSIRF.
Click to expand...

Microsoft: Untangling KNOTWEED: European private-sector offensive actor using 0-day exploits

The Microsoft Threat Intelligence Center (MSTIC) and the Microsoft Security Response Center (MSRC) found a private-sector offensive actor (PSOA) using multiple Windows and Adobe 0-day exploits, including one for the recently patched CVE-2022-22047, in limited and targeted attacks against European and Central American customers. The PSOA, which MSTIC tracks as KNOTWEED, developed malware called Subzero which was used in these attacks.
Click to expand...

PSOAs, which Microsoft also refers to as cyber mercenaries, sell hacking tools or services through a variety of business models. Two common models for this type of actor are access-as-a-service and hack-for-hire. In access-as-a-service, the actor sells full end-to-end hacking tools that can be used by the purchaser in operations, with the PSOA not involved in any targeting or running of the operation.

In hack-for-hire, detailed information is provided by the purchaser to the actor, who then runs the targeted operations. Based on observed attacks and news reports, MSTIC believes that KNOTWEED may blend these models: they sell the Subzero malware to third parties but have also been observed using KNOTWEED-associated infrastructure in some attacks, suggesting more direct involvement.
Click to expand...

guest · Aug 1, 2022

Austria Probes Claim Spyware Targeted Law Firms, Banks
August 1, 2022

Microsoft's security team earlier this week said it found that a malware called Subzero -- developed by Vienna-based company DSIRF -- was deployed in 2021 and 2022.

"Observed victims to date include law firms, banks and strategic consultancies in countries such as Austria, the United Kingdom and Panama," it wrote in a blog entry on Wednesday.
Click to expand...

Austria's interior ministry said it had not received reports of any incidents.

"Of course, (intelligence agency) DSN checks the allegations. So far, there is no proof of the use of spy software from the company mentioned," it said in a statement.
Austria's Kurier newspaper cited DSIRF as saying that Subzero had not been misused and "was developed exclusively for use by authorities in EU states" and was not commercially available.

Austria's interior ministry said it knew of the company but "has not had any business relationships" with it.
Click to expand...

Log in or Sign up

Microsoft exposes tactics of European mercenary spyware broker

guest Guest

guest Guest

Log in or Sign up

Microsoft exposes tactics of European mercenary spyware broker

guest Guest

guest Guest

Useful Searches