{"id":58357,"date":"2025-03-25T00:00:00","date_gmt":"2025-03-25T00:00:00","guid":{"rendered":"urn:uuid:7fcbdd8f-7681-3ed7-9c3e-ef2be834b378"},"modified":"2025-03-25T00:00:00","modified_gmt":"2025-03-25T00:00:00","slug":"cve-2025-26633-how-water-gamayun-weaponizes-muipath-using-msc-eviltwin","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/cve-2025-26633-how-water-gamayun-weaponizes-muipath-using-msc-eviltwin\/","title":{"rendered":"CVE-2025-26633: How Water Gamayun Weaponizes MUIPath using MSC EvilTwin"},"content":{"rendered":"

<\/p>\n

<\/div>\n

Water Gamayun not only uses these techniques in this loader, but also extensively applies them in other modules to download and execute next-stage payloads or plugins from the server. By leveraging these techniques, attackers can proxy the execution of malicious payload through legitimate Windows binaries by running non-malicious files.<\/p>\n

Conclusion<\/span><\/p>\n

Trend Research\u2019s investigation into this campaign demonstrates Water Gamayun\u2019s approach to exploiting vulnerabilities within the MMC framework. By abusing a vulnerability in the MMC framework, which we have designated as MSC EvilTwin (CVE-2025-26633), this threat actor has effectively devised a method to execute malicious code on infected machines. In this installment of our two-part series, we focused on the technical aspects of the MSC EvilTwin technique and the Trojan loader used to exploit this vulnerability. This attack employs multiple innovative techniques to maintain persistence and exfiltrate sensitive data, leveraging the manipulation of .msc files and Microsoft’s MUIPath.<\/p>\n

Our findings revealed that this campaign is actively developing, utilizing various delivery methods and custom payloads, as detailed in the modules deployed by Water Gamayun, including EncryptHub stealer, DarkWisp backdoor, SilentPrism backdoor, and Rhadamanthys stealer.<\/p>\n

Through the collaboration between Microsoft and the Trend ZDI, this zero-day attack has been disclosed and a patch has quickly been issued to address it. Enterprises need comprehensive cybersecurity solutions to combat the evolving threats exemplified by campaigns such as those conducted by Water Gamayun. With techniques that exploit vulnerabilities like MSC EvilTwin, a layered approach and advanced cybersecurity solutions are vital for safeguarding digital assets in a landscape where threat actors are continuously refining their tactics.<\/p>\n

Proactive security with Trend Vision One\u2122 <\/span><\/p>\n

Organizations can protect themselves from attacks such as those employed by Water Gamayun with Trend Vision One<\/a>\u2122<\/a> \u2013 the only AI-powered enterprise cybersecurity platform that centralizes cyber risk exposure management, security operations, and robust layered protection. This comprehensive approach helps you predict and prevent threats, accelerating proactive security outcomes across your entire digital estate. Backed by decades of cybersecurity leadership and Trend Cybertron, the industry’s first proactive cybersecurity AI, it delivers proven results: a 92% reduction in ransomware risk and a 99% reduction in detection time. Security leaders can benchmark their posture and showcase continuous improvement to stakeholders. With Trend Vision One, you\u2019re enabled to eliminate security blind spots, focus on what matters most, and elevate security into a strategic partner for innovation.<\/p>\n

Trend protections for CVE-2025-26633<\/span><\/p>\n

The following protections have been available to Trend Micro customers: <\/p>\n

Trend Vision One\u2122 – Network Security<\/b><\/p>\n

TippingPoint Intrusion Prevention Filters<\/p>\n