{"id":11862,"date":"2025-03-26T14:44:46","date_gmt":"2025-03-26T14:44:46","guid":{"rendered":"https:\/\/fusionmindlabs.com\/blogs\/encrypthub-hits-windows-with-zero-day\/"},"modified":"2025-03-26T14:44:47","modified_gmt":"2025-03-26T14:44:47","slug":"encrypthub-hits-windows-with-zero-day","status":"publish","type":"post","link":"https:\/\/fusionmindlabs.com\/blogs\/encrypthub-hits-windows-with-zero-day\/","title":{"rendered":"EncryptHub Hits Windows with Zero-Day"},"content":{"rendered":"\n<\/p>\n
\n

\ue802<\/i>Mar 26, 2025<\/span>\ue804<\/i>Ravie Lakshmanan<\/span><\/span>Windows Security \/ Vulnerability<\/span><\/p>\n<\/div>\n

\n
\n<\/p>\n

<\/a>\n<\/div>\n

The threat actor known as EncryptHub<\/a> took advantage of a recently patched security vulnerability in Microsoft Windows, using it as a zero-day to distribute various malware families, including backdoors and information stealers like Rhadamanthys and StealC.<\/p>\n

According to Trend Micro researcher Aliakbar Zahravi, “In this attack, the threat actor manipulates .msc files and the Multilingual User Interface Path (MUIPath) to download and execute malicious payload, maintain persistence, and steal sensitive data from infected systems,” as stated in an analysis<\/a>.<\/p>\n

The vulnerability in question, CVE-2025-26633 (CVSS score: 7.0), is described by Microsoft as an improper neutralization vulnerability in Microsoft Management Console (MMC<\/a>) that could allow an attacker to bypass a security feature locally. It was fixed<\/a> by the company earlier this month as part of its Patch Tuesday update.<\/p>\n

\n

\n
\n\"Cybersecurity\"
\n<\/a>
\n<\/center>\n<\/div>\n

Trend Micro has given the exploit the moniker MSC EvilTwin, tracking the suspected Russian activity cluster under the name Water Gamayun. The threat actor, recently the subject of analyses<\/a> by PRODAFT and Outpost24, is also referred to as LARVA-208.<\/p>\n

CVE-2025-26633, at its core, leverages the Microsoft Management Console framework (MMC) to execute a malicious Microsoft Console (.msc) file by means of a PowerShell loader referred to as MSC EvilTwin loader.<\/p>\n

Specifically, it involves the loader creating two .msc files with the same name: one clean file and its rogue counterpart that is dropped in the same location but within a directory named “en-US.” The idea is that when the former is run, MMC inadvertently picks the malicious file instead and executes it. This is accomplished by exploiting MMC’s Multilingual User Interface Path (MUIPath) feature.<\/p>\n

\n
\n\"Windows
\n<\/a>\n<\/div>\n

“By abusing the way that mmc.exe uses MUIPath, the attacker can equip MUIPath en-US with a malicious .msc file, which causes the mmc.exe to load this malicious file instead of the original file and execute it without the victim’s knowledge,” Zahravi explained.<\/p>\n

EncryptHub has also been observed adopting two other methods to run malicious payload on an infected system using .msc files:<\/p>\n