Loading malware…
DarkWisp is a Windows backdoor used by the financially motivated threat actor EncryptHub, also tracked as Water Gamayun and LARVA-208. It was observed in campaigns documented in March 2025 that exploited CVE-2025-26633, a Microsoft Management Console security-feature bypass vulnerability known as MSC EvilTwin. These attacks use malicious console files to bypass MMC security checks and execute attacker-controlled code, enabling backdoor installation. Delivery campaigns have used phishing emails carrying malicious console files or installers. DarkWisp forms part of an arsenal that also includes the SilentPrism backdoor and information-stealing malware such as Stealc and Rhadamanthys; the capabilities of those other tools should not be attributed to DarkWisp.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Trustwave SpiderLabs said it recently observed an EncryptHub campaign that brings together social engineering and the exploitation of a vulnerability in the Microsoft Management Console (MMC) framework (CVE-2025-26633, aka MSC EvilTwin) to trigger the infection routine via a rogue Microsoft Console (MSC) file. | Trend Micro in March 2025, uncovering attacks that deliver two backdoors called SilentPrism and DarkWisp.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
This financially motivated group has been active in campaigns combining zero-day exploitation ... with custom malware such as SilentPrism, DarkWisp, and bespoke stealers.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Backdoor delivered following exploitation of a Windows zero-day (CVE-2025-26633) via an MSC EvilTwin technique; attributed to Water Gamayun.
DarkWisp is a backdoor malware variant used in campaigns exploiting Microsoft Management Console vulnerabilities.
Named as a possible backdoor/RAT family in Water Gamayun’s arsenal that could be installed by the final loader, though the specific family was not validated in this case.
Backdoor malware deployed after exploitation of CVE-2025-26633, enabling credential theft, lateral movement, and data exfiltration.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.