Security researchers at Trend Micro say one of the six zero-days patched by Microsoft earlier this month was being exploited in the wild by a known Russian ransomware gang.
Exploitation of the zero-day, flagged as CVE-2025-26633 and fixed on Patch Tuesday, is being pinned on a group identified as EncryptHub (an affiliate of RansomHub that Trend Micro calls Water Gamayu).
According to Trend Micro documentation, the data extortion gang was seen launching exploits against the defect in the Microsoft Management Console (MMC) framework to execute malicious code and exfiltrate data from targeted systems.
The technique abuses MMC’s handling of Microsoft Console (.msc) files and the Multilingual User Interface Path (MUIPath). In a typical attack, Trend Micro said the ransomware gang creates two .msc files with identical names: a clean file and a malicious version dropped into an “en-US” directory.
When mmc.exe is executed, it loads the malicious file via the MUIPath feature instead of the legitimate one. This allows the attacker to execute commands without triggering suspicion, Trend Micro warned.
The company’s threat hunters also warned that the group uses a shell command execution technique that leverages the ExecuteShellCommand method within MMC’s ActiveX control snap-in to download and run subsequent payloads.
Another method involves creating mock trusted directories that mimic legitimate system paths, enabling the loader to drop malicious files under the guise of authenticity, Trend Micro explained.
“Our findings revealed that this campaign is actively developing, utilizing various delivery methods and custom payloads, as detailed in the modules deployed by Water Gamayun, including EncryptHub stealer, DarkWisp backdoor, SilentPrism backdoor, and Rhadamanthys stealer,” according to the report.
This isn’t the first time zero-day exploitation has hit the Microsoft Management Console (MMC) feature in Windows. Last October, Redmond publicly confirmed attackers were seen rigging Microsoft Saved Console (MSC) files to execute remote code on targeted Windows systems.
Related: Microsoft Flags Six Active Zero-Days, Patches 57 Flaws
Related: Microsoft Confirms Exploited Zero-Day in Windows MMC
Related: Microsoft Warning: Zero-Day Exploitation of Task Scheduler Flaw
