Water Gamayun

Executive Summary

Water Gamayun is a financially motivated, likely Russian threat actor that advanced exploitation of the MS Excel 365 zero‑day CVE-2025-26633 (MSC EvilTwin) to deliver encrypted PowerShell payloads and persist via custom backdoors such as SilentPrism and DarkWisp. It employs signed MSI files, .msc file manipulation, and LOLBins for execution, targeting defense, financial services, government, utilities, and critical infrastructure in China, the United States, and Russia.

Goals & Targeting

The primary motivation is financial gain through data theft, ransomware deployment, or extortion. Water Gamayun selectively targets strategic sectors—defense, government, utilities, finance, and critical infrastructure—in jurisdictions that offer both economic value and opportunities to disrupt operations. The actor seeks high‑value, highly connected environments where compromised data can be leveraged for blackmail or leverage in broader geopolitical maneuvers.

Key Capabilities

• Exploitation of MSC EvilTwin (CVE-2025-26633) to inject code into mmc.exe
• Multi‑stage obfuscated PowerShell payloads
• Password‑protected archives and decoy documents
• Creation of directories mimicking legitimate system paths (e.g., C:\Windows System32)
• Embedding Base64‑encoded payload strings in loader files
• Persistence via SilentPrism backdoor
• Persistence via DarkWisp backdoor
• Deployment of malicious payloads through signed Microsoft Installer (.msi) files
• Manipulation of Windows .msc files and use of MUIPath for execution control
• Leveraging LOLBins for delivery and execution
• Credential and data theft using EncryptHub Stealer variants, Stealc, Rhadamanthys

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Water Gamayun demonstrates a high-velocity, opportunistic operational tempo. It typically exploits zero‑day vulnerabilities for initial compromise, then layers obfuscation and persistence tools to maintain stealth. Victims are chosen from sectors with valuable data or critical services; the actor prefers environments where lateral movement can expand reach rapidly. Notable past operations include deployment against a US defense contractor using the MSC EvilTwin flaw and subsequent use of signed MSI files to deliver malicious shells. The actor’s campaigns have been observed to pivot quickly across domains, often changing C2 endpoints and leveraging legitimate protocols for exfiltration.

IOC Patterns

• Use of .msc files for malicious execution
• Creation of directories mimicking system paths with spaces
• Embedded Base64‑encoded payload strings within loader files
• Password‑protected archives used as decoys
• Signed MSI file deployment
• Exploitation of CVE-2025-26633 via mmc.exe

Recommended Actions

• Apply timely patches for CVE-2025-26633 and related MMC vulnerabilities
• Monitor .msc file execution for anomalous behavior
• Deploy threat detection that flags hidden PowerShell activity and obfuscated payloads
• Alert on creation of suspicious directories or names mimicking system paths
• Validate legitimacy of signed MSI deployments from trusted sources
• Implement application whitelisting to restrict LOLBin usage
• Conduct regular hunting for SilentPrism and DarkWisp backdoors
• Use sandbox analysis to review password‑protected archives

Suggested Tags