Security researchers have identified a Russian hacking group, Water Gamayun (also known as EncryptHub and LARVA-208), exploiting a recently-patched Windows vulnerability to deploy sophisticated backdoors. The group has evolved their tactics to include new malware called SilentPrism and DarkWisp.
## Attack Methods
The threat actors primarily deploy malware through:
– Malicious provisioning packages (.ppkg)
– Signed Microsoft Installer files (.msi)
– Windows Console files (.msc)
They’ve been actively exploiting CVE-2025-26633 (MSC EvilTwin), a vulnerability in the Microsoft Management Console framework, to execute malware via rogue .msc files.
## Malware Arsenal
The group’s toolkit includes:
1. **SilentPrism**: A PowerShell backdoor that establishes persistence, executes multiple shell commands simultaneously, and maintains remote control while employing anti-analysis techniques.
2. **DarkWisp**: Another PowerShell backdoor enabling system reconnaissance, data exfiltration, and persistence. It communicates through TCP port 8080 using base64-encoded commands.
3. **MSC EvilTwin Loader**: Exploits CVE-2025-26633 to deploy Rhadamanthys Stealer while cleaning up evidence.
4. **EncryptHub Stealer Variants**: Custom PowerShell stealers that collect extensive system information, extract passwords, browser credentials, and target cryptocurrency wallet recovery phrases.
## Evolving Tactics
Initially using GitHub to distribute malware through a fake WinRAR website, Water Gamayun has since transitioned to their own infrastructure. Their .msi installers disguise as legitimate software like DingTalk and VooV Meeting.
The group has also pioneered a new living-off-the-land binary technique using IntelliJ’s “runnerw.exe” to execute remote PowerShell scripts. Their command-and-control infrastructure enables remote access through AnyDesk and allows operators to send encoded commands to compromised systems.
Security experts note that Water Gamayun’s adaptability and sophisticated infrastructure enable them to maintain persistence, control infected systems, and effectively hide their activities.