Microsoft has identified malicious software created by Austrian firm DSIRF on the computer systems of some of its clients in at least three countries. The software, a spying tool named “Subzero,” was intended for official use within European Union states only, according to DSIRF.
On Wednesday, Microsoft reported that DSIRF had deployed the spyware, capable of accessing confidential information such as passwords and login credentials, at several unidentified banks, law firms, and strategic consultancies. In an emailed statement, DSIRF emphasized that
“Subzero is a software of the Austrian DSIRF GesmbH, developed only for official use in states of the EU. It is neither offered, sold, nor made available for commercial use.”
DSIRF firmly denied any misuse of Subzero software based on the facts described by Microsoft. However, it remains unclear which EU member state governments were using the tool. DSIRF has not responded to requests for further comment.
Austria’s interior ministry informed local news agency APA on Friday that it is investigating Microsoft’s claims. The ministry did not respond to requests from Reuters for comment.
The issue of spyware has gained increased attention in Europe and the United States following revelations about Pegasus, an Israeli-developed spyware used by governments to spy on journalists and dissidents.
DSIRF stated that they had commissioned an independent expert to investigate Microsoft’s claims and had reached out to the U.S. tech giant for collaboration on the matter. Microsoft declined to provide additional comments.
In a blog post on Thursday, Microsoft revealed that DSIRF had developed four “zero-day exploits,” which are serious software flaws highly valued by hackers and spies because they remain effective even when the software is up to date.
Last year, German news website Netzpolitik published an internal DSIRF presentation promoting Subzero, listing several previous commercial clients as references. Two companies named in that presentation, SIGNA Retail and Dentons, told Reuters they had not used the spyware and had not consented to be listed as references for DSIRF.
