KNOTWEED is an Austria-based PSOA named DSIRF GmbH that develops and sells the Subzero malware toolset. According to Microsoft, a recent campaign used an unknown, probably 0day, PDF-based RCE in Adobe Reader. The exploit chain starts with writing a malicious DLL to disk from the sandboxed Adobe Reader renderer process. For privilege escalation, CVE-2022-22047 was utilized. An application manifest with an undocumented attribute specified the path of the malicious DLL. When the targeted system process next spawned, the attribute in the malicious activation context was used, the malicious DLL was loaded from the given path, and system-level code execution was achieved. Previous campaigns from 2021 utilized an Adobe Reader exploit (CVE-2021-28550) in conjunction with Windows privilege escalation exploits (CVE-2021-31199 and CVE-2021-31201).
Interestingly, netzpolitik.org found DSIRF’s Subzero pitch in the mailbox of wanted former Wirecard executive Jan Marsalek, and the company is said to have strong ties to Moscow. DSIRF told Reuters that Subzero was developed exclusively for official use in EU states, while Austria’s interior ministry said it was investigating Microsoft’s claims. Which EU states, DSIRF did not say.