KNOTWEED Assessment Summary
ID: 5ce3a48a-6086-591f-9e34-b6fcccdb55ae
STIX ID: report--5ce3a48a-6086-591f-9e34-b6fcccdb55ae
Feed Name: Elastic Security Labs
Threat Score
This Elastic report summarizes MSTIC findings on KNOTWEED (attributed to DSIRF), a private-sector offensive actor using 0-day Adobe and Windows exploits to deploy Subzero spyware against targeted legal, financial, and NGO victims in Europe and Latin America; it details the spyware components and capabilities (credential theft, reconnaissance, persistence), Elastic detections and hunting queries, and recommended countermeasures.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.