Gamayun APT Exploits New MSC EvilTwin Vulnerability to Deliver Malicious Payloads

Water Gamayun, a Russia‑aligned advanced persistent threat (APT) group, has launched a new multi‑stage intrusion campaign that weaponizes the recently disclosed MSC EvilTwin vulnerability in Windows Microsoft Management Console (MMC).

Leveraging a blend of compromised infrastructure, social engineering, and heavily obfuscated PowerShell, the attackers exploited CVE‑2025‑26633 to inject malicious code into mmc.exe, ultimately delivering hidden payloads and final malware loaders while minimizing user suspicion.

The attack chain begins with a seemingly harmless Bing search for “belay,” which returns a result for the legitimate BELAY Solutions domain, belaysolutions[.]com.

That site was likely injected with malicious JavaScript designed to silently redirect users to a newly registered lookalike domain, belaysolutions[.]link.

There, victims were offered what appeared to be a PDF brochure: a double‑extension file named Hiring_assistant.pdf.rar, exploiting user trust in recognizable document formats.

When opened, the RAR archive drops an .msc file masquerading as a safe document asset. This file becomes the pivot point for exploiting MSC EvilTwin, transforming a routine user interaction into a foothold for a sophisticated PowerShell‑driven intrusion.

MSC EvilTwin (CVE‑2025‑26633)

The core of the operation centers on CVE‑2025‑26633, an MSC EvilTwin vulnerability in MMC’s multilingual path resolution.

When the user launches the dropped .msc, mmc.exe resolves malicious MUI paths that load a rogue snap‑in instead of the legitimate one.

Embedded TaskPad commands inside this snap‑in execute a Base64‑encoded PowerShell payload via -EncodedCommand, initiating the first hidden script stage without any visible prompts.

This abuse of a trusted Windows binary allows the attackers to proxy execution through mmc.exe, complicating behavioral detection and blending malicious activity into administrative tooling commonly found in enterprise environments.

The Stage‑1 PowerShell script downloads UnRAR.exe and a password‑protected RAR archive, extracts the following payload, introduces short delays, and then uses Invoke-Expression to run the extracted script.

This script is heavily obfuscated, using nested Base64 with UTF‑16LE encoding and underscore‑based string cleanup, a hallmark of Water Gamayun tradecraft.

Stage‑2 PowerShell compiles a minimal .NET class named WinHpXN to call the Win32 ShowWindow API, hiding console windows to minimize user awareness.

It then opens a benign‑looking decoy PDF to maintain the illusion of a normal document interaction while downloading, extracting, and executing the final loader ItunesC.exe multiple times for persistence.

Throughout these stages, password‑protected archives, strong 21‑character alphanumeric passwords, and randomized paths are used to frustrate sandboxing and static analysis.

Attribution to Water Gamayun

The final binary, iTunesC.exe, is responsible for installing backdoors or information‑stealing malware.

While the exact family could not be confirmed due to non‑responsive command‑and‑control (C2) infrastructure, Water Gamayun’s known arsenal includes backdoors such as SilentPrism and DarkWisp and stealers like EncryptHub and Rhadamanthys, any of which could feasibly be deployed in this stage.

Zscaler Threat Hunting attributed this campaign to Water Gamayun with high confidence by correlating multiple factors: rare exploitation of MSC EvilTwin (CVE‑2025‑26633), distinctive PowerShell obfuscation patterns, the use of the WinHpXN window‑hiding.

.NET stub, dual‑path infrastructure hosted on a single IP (103[.]246[.]147[.]17 with randomized prefixes like /cAKk9xnTB/ and /yyC15x4zbjbTd/), and consistent employment‑themed and consumer‑style lures such as “Hiring_assistant.pdf” and “iTunesC.”

Together, these elements reflect Water Gamayun’s broader 2025 playbook: exploiting novel vulnerabilities, abusing trusted binaries, and layering obfuscation and OPSEC to quietly harvest credentials, exfiltrate sensitive data, and maintain long‑term footholds in high‑value enterprise and government networks.

Indicators of Compromise (IoCs)

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.