Denim TsunamiThreat actor
- DSIRF
- KNOTWEED
Denim Tsunami is a threat actor group that has been involved in targeted attacks against European and Central American customers. They have been observed using multiple Windows and Adobe 0-day exploits, including one for CVE-2022-22047, which is a privilege escalation vulnerability.From MISP Galaxy
Last reported 4 months ago, by Sekoia.io2 reports
ATT&CK techniques
3 techniques · each with the sentence it comes from- T1059.005Visual Basic
“Attempts to use a Visual Basic for Applications (VBA) script for initial execution generates a Memory Threat Prevention Alert: Shellcode Injection event.”
- T1546.015Component Object Model Hijacking
“Component Object Model Hijacking”
- T1684Social Engineering
“This method significantly reduces the risk of detection and failure, as it does not rely on preemptive social engineering.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
Predators for Hire: Commercial Surveillance Vendors Overview“Many EU-based companies—such as RCS Lab, MSAB, and DSIRF—develop and export intrusive surveillance tools, often to countries with questionable human rights records.”
-
KNOTWEED Assessment Summary“KNOTWEED Assessment Summary”
Indicators in its reports
named in the reports above- gov[.]ukin 1 report
- surveillancewatch[.]ioin 1 report
Copy these 2 indicators · defanged
Thanks — we review every report.