Uptime Hamster: 15d 10h 54mDeploy: 13 Jul 2026 08:04Updated: 2026-07-14
Logo del actor de amenaza Denim Tsunami

Denim Tsunami

0 incidentes 0 paises 0 sectores apt AT Ultimo: -
Aliases: DSIRF, KNOTWEED
Ver en IntelTracker → APTTrail →
Denim Tsunami is an Austrian private-sector offensive actor (PSOA) that emerged around February 2020, initially tracked by Microsoft as KNOTWEED and linked to the company DSIRF GmbH. This group specializes in developing and selling sophisticated surveillanceware, known as Subzero, and is also observed engaging in direct offensive cyber operations. Their primary motivation is cyber espionage and financial gain, often involving corporate espionage and surveillance. Denim Tsunami distinguishes itself by combining the sale of advanced cyber tools with direct involvement in targeted attacks, frequently exploiting zero-day vulnerabilities in widely used software. The group operates under the aliases KNOTWEED and DSIRF, and was officially designated 'Denim Tsunami' by Microsoft in April 2023.

Aliases del actor

DSIRFKNOTWEED

Actores similares

knotweedactor · 1Caramel Tsunamiapt · 0Carmine Tsunamiapt · 0Blue Tsunamiapt · 0
Tecnicas MITRE
T1566, T1071.001, T1059.001, T1210, T1078.003
Tipo
apt
Pais origen
AT
Motivacion
-
Impacto
4
Actualizado
Sat, 03 Fe

Sectores objetivo (SOCRadar)

Energy & Utilities ManufacturingWholesale TradeInformation ServicesFinanceProfessional&Technical ServicesRetailSoftware PublishersBankingOffices of Lawyers