Untangling KNOTWEED: European private-sector offensive actor using 0-day exploits | Microsoft Security Blog
Tags
cmtmf-attack-pattern: Masquerading
country: Austria Israel Panama United Kingdom
maec-delivery-vectors: Watering Hole
attack-pattern: Data Direct Model Models Code Signing - T1553.002 Credentials - T1589.001 Domains - T1583.001 Domains - T1584.001 Exploits - T1587.004 Exploits - T1588.005 Ip Addresses - T1590.005 Keylogging - T1056.001 Keylogging - T1417.001 Lsa Secrets - T1003.004 Malware - T1587.001 Malware - T1588.001 Masquerading - T1655 Powershell - T1059.001 Server - T1583.004 Server - T1584.004 Software - T1592.002 Windows Credential Manager - T1555.004 Tool - T1588.002 Code Signing - T1116 Credential Dumping - T1003 Masquerading - T1036 Powershell - T1086 Masquerading
Show in Graph
Common Information
Type Value
UUID 87f1bb17-93a8-4839-82ed-80cd269cd2f9
Fingerprint a5302c3318af86e3
Analysis status DONE
Considered CTI value 2
Text language
Published July 27, 2022, 7 a.m.
Added to db Oct. 24, 2023, 1:42 p.m.
Last updated Oct. 16, 2024, 3:19 a.m.
Headline Untangling KNOTWEED: European private-sector offensive actor using 0-day exploits
Title Untangling KNOTWEED: European private-sector offensive actor using 0-day exploits | Microsoft Security Blog
Detected Hints/Tags/Attributes 121/4/14
Source URLs
Redirection Url
Details Source https://www.microsoft.com/en-us/security/blog/2022/07/27/untangling-knotweed-european-private-sector-offensive-actor-using-0-day-exploits/
URL Provider
Details Provider Source level domain
Details microsoft.com www.microsoft.com
Attributes
Details Type #Events CTI Value
Details CVE 19 
cve-2022-22047
Details CVE 10 
cve-2021-31199
Details CVE 9 
cve-2021-31201
Details CVE 11 
cve-2021-28550
Details CVE 6 
cve-2021-36948
Details CVE 2 
cve-2022-2204
Details Domain 2 
vultrobjects.com
Details Domain 2 
acrobatrelay.com
Details Domain 2 
demo3.dsirf.eu
Details Domain 2 
debugmex.dsirflabs.eu
Details Domain 2 
szstaging.dsirflabs.eu
Details Deprecated Microsoft Threat Actor Naming Taxonomy (Groups in development) 10 
DEV-0196
Details Windows Registry Key 7 
HKLM\SOFTWARE\Classes\CLSID
Details Windows Registry Key 19 
HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest