Denim Tsunami
Denim Tsunami is an Austria-attributed threat actor group, tracked by Brandefense.
- KNOTWEED
- DSIRF
- Origin
- Austria
- Techniques
- 0
- Exploited CVEs
- No CVE data
- Record updated
About Denim Tsunami.
Denim Tsunami is a threat actor group that has been involved in targeted attacks against European and Central American customers. They have been observed using multiple Windows and Adobe 0-day exploits, including one for CVE-, which is a privilege escalation vulnerability. Denim Tsunami developed a custom malware called Subzero, which has capabilities such as keylogging, capturing screenshots, data exfiltration, and running remote shells. They have also been associated with the Austrian spyware distributor DSIRF.
Last updated Oct 9, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.