Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Microsoft identified Austrian firm DSIRF as a private-sector cyber operations company linked to Subzero spyware and targeted attacks, while separate investigative reporting described its owner’s business and personal connections to Russia. Those are distinct strands of evidence: Microsoft’s technical analysis did not establish that the Russian government directed DSIRF.
Who is DSIRF, and what did Microsoft find?
DSR Decision Supporting Information Research Forensic GmbH (DSIRF) is an Austria-based private-sector offensive actor, according to Microsoft Threat Intelligence. Microsoft initially tracked the activity as KNOTWEED; in an April 2023 taxonomy update, it said the actor was now tracked as Denim Tsunami. Microsoft’s technical report, published July 27, 2022, linked DSIRF to Subzero spyware and attacks on organizations in Europe and Central America.
Microsoft said it had observed victims that included law firms, banks and strategic consultancies in Austria, the UK and Panama. It cautioned that the location of a victim does not necessarily reveal where a DSIRF customer was located.
How the company’s operations were described
Microsoft explained that private-sector offensive actors can operate through access-as-a-service, in which buyers obtain tools to conduct operations, or hack-for-hire, in which the provider carries out operations according to a customer’s targeting requirements. Microsoft assessed that KNOTWEED may have used a mix: selling Subzero to third parties while also using infrastructure associated with the actor in some attacks.
#1 Best Overall
Microsoft cited several technical links between DSIRF and the activity: command-and-control infrastructure linked directly to the company, a DSIRF-associated GitHub account used in an attack, and an exploit signed with a code-signing certificate issued to DSIRF. Microsoft also said it confirmed that one victim had not commissioned red-team or penetration-testing work, and characterized the activity as unauthorized and malicious.
What Subzero could do, and how it was delivered
Delivery methods Microsoft documented
Microsoft’s observations cover activity from 2021 and 2022, not evidence that the same techniques remain in use today. In May 2022, it found a PDF sent by email that delivered an Adobe Reader remote-code-execution exploit and a Windows privilege-escalation exploit chain. Microsoft could not obtain the PDF or the Adobe exploit component; it assessed with medium confidence that the Adobe exploit was a zero-day. The Windows vulnerability was CVE-2022-22047, which was patched in July 2022.
The report also described earlier exploit chains from 2021 and a malicious Excel document using obfuscated macros.
Capabilities after infection
Microsoft described Corelump as Subzero’s main payload. It resides in memory and can capture keystrokes and screenshots, exfiltrate files, provide a remote shell and run plugins downloaded from the actor’s command-and-control server. Microsoft also observed post-compromise activity including credential dumping and attempts to access email with the stolen credentials.
Rank #3
What the reported Russia ties do—and do not—show
FOCUS Online reported in November 2021 that the Austrian Finance Ministry identified Peter Dietenberger as DSIRF’s owner. The outlet described Dietenberger’s work connecting Western businesses with Russian contacts and reported that a visa identified him as a guest of the presidential administration. FOCUS also reported that a DSIRF company presentation was forwarded to Jan Marsalek, the former Wirecard executive.
These reports provide context for describing personal, business and political links to Russia. They do not establish that the Russian government commissioned or controlled DSIRF’s cyber operations. Microsoft’s technical findings linked infrastructure, tools, a certificate and an account to DSIRF; its report did not attribute the operations to Russian state direction.
FOCUS reported that DSIRF managing director Drazen Mokic called the presentation confidential and said it was intended for authorities and potential investors. The outlet also reported that Austria’s interior and justice ministries denied working with DSIRF; it said the ministries denied involvement by police, the judiciary and intelligence services as well. These statements should be understood as reported claims and denials, not as technical findings about the cyber activity.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →What organizations can take from the case
Microsoft’s July 2022 report recommended several defensive steps in response to the activity it documented:
Best Value
- Apply the July 2022 security update for CVE-2022-22047.
- Update Microsoft Defender and use Microsoft’s published indicators of compromise to investigate potentially affected systems.
- Restrict Excel macro execution and ensure runtime macro scanning is enabled.
- Enable multifactor authentication and review remote-access authentication activity for anomalies.
These are historical recommendations tied to Microsoft’s 2022 findings; administrators should consult current vendor guidance before making present-day operational decisions.
Quick Recap
Timeline
- November 2021: FOCUS Online reported on a DSIRF presentation and details about the owner’s reported connections.
- July 27, 2022: Microsoft published its technical analysis of DSIRF, KNOTWEED and Subzero.
- July 28, 2022: ITPro covered Microsoft’s findings alongside earlier reporting about the company and Russia-related allegations.
- April 2023: Microsoft said it had renamed the actor Denim Tsunami in its tracking taxonomy.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
