EncryptHub

EncryptHub is a financially motivated Russian threat actor, also tracked as LARVA-208 and Water Gamayun. The content describes it as a Russian or Russia-aligned hacking group that gained prominence in mid-2024 and has been associated with credential theft, access brokering, information-stealing campaigns, and malware delivery. Reported activity includes targeting enterprise and government networks, telecom, finance, defense, manufacturing, Web3 developers, and Steam users. A related subgroup, LARVA-148, is described as managing domain acquisitions and attacks. The actor is repeatedly linked to exploitation of the Windows Microsoft Management Console vulnerability CVE-2025-26633, dubbed "MSC EvilTwin," including continued exploitation after patching. Reported delivery methods include phishing, fake IT support messages over Microsoft Teams, videoconferencing lures such as a fake platform named RivaTalk, compromised websites, abuse of Brave Support to host payload ZIPs, and rogue or paired benign/malicious .msc files. The described tradecraft includes social engineering, PowerShell-based multi-stage loaders, persistence, AES-encrypted command execution, SOCKS5 tunneling, DLL sideloading via a legitimate Symantec ELAM binary, use of deceptive paths such as "C:\Windows \System32," and living-off-the-land techniques involving mmc.exe. Tooling and malware directly associated in the content include Fickle Stealer, SilentCrystal, SilentPrism, DarkWisp, HijackLoader, Vidar, and Golang backdoors. Fickle Stealer is described as stealing credentials, browser data, cookies, sensitive files, system information, cryptocurrency wallet data, and other host data. In Steam-related activity, EncryptHub reportedly compromised the Chemia game to distribute HijackLoader, which downloaded Vidar, and also deployed Fickle Stealer. The actor has also reportedly abused Steam to distribute information stealers more broadly. The content states that at least 618 organizations worldwide were compromised in one EncryptHub campaign. It also notes OPSEC failures exposing the actor's own infrastructure and reports that EncryptHub used Telegram bots and ChatGPT in operations. One article additionally describes EncryptHub as a persona tied to malware campaigns, credential theft, and access brokering, and says Microsoft credited "EncryptHub" with responsibly disclosing two Windows vulnerabilities in March 2025.