Loading story…
KNOTWEED, an activity group attributed to Austrian private-sector offensive actor DSIRF, conducted targeted espionage campaigns against legal, financial, and NGO organizations in Europe and Central America. The group used zero-day vulnerabilities in Adobe Reader and Microsoft Windows to deploy DSIRF’s Subzero surveillance malware against selected victims in Europe and Latin America.
Subzero comprises the Jumplump persistence component and Corelump primary backdoor, providing credential theft, system-location discovery, host reconnaissance, and remote-access capabilities. Microsoft identified a VBA-based initial-access chain in the activity; Elastic reported its endpoint protection could detect and stop the associated shellcode-injection behavior, while noting it had not observed customer telemetry tied to the targeted campaign at the time of its assessment.
TTPs, infrastructure, and targeting history in one profile.
1 event from the most recent confirmed update back to the earliest known activity.
Microsoft Threat Intelligence Center disclosed KNOTWEED, an activity group attributed to DSIRF, which used Adobe Reader and Windows zero-day exploits to deploy Subzero spyware against legal, financial, and NGO targets in Europe and Latin America. Subzero used Jumplump for persistence and Corelump for host operations, including credential theft, reconnaissance, system-location collection, and remote access.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers documented fresh **ZeroAccess** (also known as **Sirefef**, **0Access**, **ZAccess**, **Max++**, and **Smiscer**) samples that remained in contact with active command-and-control infrastructure and used stealth techniques to persist on infected Windows systems. The malware was distributed through lure filenames posing as free videos, pornography, Flash Player updates, and generic readme executables, then injected a hidden library into `Explorer.exe` and stored components in concealed paths such as `RECYCLER` and `$Recycle.Bin`. Analysts reported that common cleanup tools struggled to expose the infection after compromise, requiring memory extraction of the hidden DLL to recover artifacts tied to filesystem manipulation, cryptographic functions, and peer-to-peer components such as `p2p.32.dll`. Reverse-engineering references describe ZeroAccess as an advanced rootkit platform built around a user-mode dropper, a kernel-mode stealth driver, and process injection, with operators using it to silently install additional malware including **FakeAV** and potentially credential- or finance-theft payloads. Network captures from one infected host showed communications with numerous external IP addresses, including **81.17.26.187** and **67.81.86.2**, consistent with the botnet's peer-to-peer activity, while antivirus detections identified the samples under names such as **ZAccess**, **Sirefef**, **Kryptik**, and generic trojan labels. Supporting analysis also linked parts of the malware's hosting and origin infrastructure to **Ecatel** and alleged ties to the **Russian Business Network (RBN)**.
Aug 15, 2026
**Fancy Bear (APT28)** has been attributed with high confidence to *Operation Neusploit*, a campaign targeting users in Central and Eastern Europe by weaponizing **CVE-2026-21509**, a **Microsoft RTF** parsing zero-day that enables arbitrary code execution via specially crafted RTF documents. Reported lures were written in multiple languages (including English, Romanian, Slovak, and Ukrainian) and targeted victims in **Ukraine, Slovakia, and Romania**. Microsoft issued an **out-of-band patch** for CVE-2026-21509 on **January 26, 2026**, with in-the-wild exploitation observed shortly after. Post-exploitation activity was described as a multi-stage chain that retrieves a malicious dropper DLL from attacker infrastructure and then deploys different payload paths, including **MiniDoor** (focused on Outlook email theft/exfiltration) and **PixyNetLoader**, which ultimately leads to a **Covenant Grunt** implant for command-and-control. The campaign also uses **evasion and targeting controls**, including region-restricted payload delivery (e.g., only serving malicious DLLs to requests from targeted geographies and specific `User-Agent` patterns) and persistence techniques such as **COM hijacking**, plus additional tradecraft like **steganography in PNG files** and shellcode loading to execute the final implant.
Jun 29, 2026
Researchers reported overlapping malware campaigns that use fake or trojanized PDF reader packages to compromise Windows systems through **DLL sideloading**. Cisco Talos identified **PXA Stealer** targeting government and education organizations, while Beazley Security and SentinelLabs said the Python-based infostealer has operated at scale since late 2024, affecting more than **4,000 victims in 62 countries**. The activity has been linked to Vietnamese-speaking threat actors who used phishing, signed software such as **Haihaisoft PDF Reader** and **Microsoft Word 2013**, and multi-stage loaders to evade detection and establish persistence through Windows `Run` registry keys. The malware chains ultimately steal browser credentials, cookies, autofill data, cryptocurrency wallet contents, and other sensitive application data, with exfiltration routed through **Telegram bots** and **Cloudflare Workers** and ties observed to the **Sherlock** stolen-data marketplace. In a related development, Kroll said **XWORM** operators adopted a similar fake PDF reader delivery chain using **Ghost Crypt**, packaging a renamed Haihaisoft executable, a malicious DLL, and a decoy PDF in a ZIP archive. That infection path uses a "process hypnosis" technique to inject payloads into `csc.exe`, persists via `rundll32.exe`, and ends with a plugin-based RAT capable of information theft and ransomware-related actions.
Aug 14, 2026