Loading malware…
SilentPrism is a Windows backdoor associated with the financially motivated threat actor EncryptHub, also tracked as Water Gamayun and LARVA-208. It was identified in March 2025 in campaigns exploiting CVE-2025-26633, a Microsoft Management Console security-feature bypass vulnerability known as MSC EvilTwin. These attacks use malicious Microsoft Console files to bypass security checks and execute attacker-controlled code, leading to backdoor installation. Phishing emails delivering malicious console files or installers have been used in these campaigns. SilentPrism has been deployed alongside the DarkWisp backdoor and information-stealing malware in EncryptHub’s broader operations.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Trustwave SpiderLabs said it recently observed an EncryptHub campaign that brings together social engineering and the exploitation of a vulnerability in the Microsoft Management Console (MMC) framework (CVE-2025-26633, aka MSC EvilTwin) to trigger the infection routine via a rogue Microsoft Console (MSC) file. | Trend Micro in March 2025, uncovering attacks that deliver two backdoors called SilentPrism and DarkWisp.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
This financially motivated group has been active in campaigns combining zero-day exploitation ... with custom malware such as SilentPrism, DarkWisp, and bespoke stealers.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Backdoor delivered following exploitation of a Windows zero-day (CVE-2025-26633) via an MSC EvilTwin technique; attributed to Water Gamayun.
SilentPrism is a backdoor malware variant used in campaigns exploiting Microsoft Management Console vulnerabilities.
Referenced as part of Water Gamayun’s toolkit; likely used for stealthy access/persistence and data theft, but not confirmed as the final payload in this incident.
Backdoor malware installed via exploitation of CVE-2025-26633, used for persistent access and lateral movement.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.