EncryptHub Abuses Brave Support in New Campaign Exploiting MSC EvilTwin Flaw
Security researchers have uncovered a new campaign by the EncryptHub actor, exploiting the now-patched Windows flaw CVE-2025-26633 ("MSC EvilTwin") using rogue MSC files and social engineering tactics. This vulnerability allows attackers to bypass security features locally and execute malicious .msc files.
The Exploitation Method
The EncryptHub campaign combines social engineering with the exploitation of the Microsoft Management Console (MMC): CVE-2025-26633. The attack chain begins with fake IT messages on Microsoft Teams, which gain remote access to the targeted organization. A PowerShell loader fetches runner.ps1, which drops two .msc files that exploit the MSC EvilTwin vulnerability.
Attackers then use the MSC EvilTwin vulnerability to allow mmc.exe to load an identically named .msc file from the MUIPath (e.g., en-US) and execute the attacker's copy. The runner.ps1 script inserts the C2 URL into that file, which downloads build.ps1. Build.ps1 steals system info, establishes persistence, and runs AES-encrypted commands from the C2, including deploying Fickle Stealer.
New Tools in the EncryptHub Arsenal
Researchers have also detailed two new tools in the EncryptHub arsenal: a Golang loader named SilentCrystal that abuses Brave Support to host payloads. This tool creates a fake Windows directory to bypass defenses and exploits MSC EvilTwin to execute malware.
The second tool is a Golang SOCKS5 backdoor that works in client or server mode. It sends stolen system details via Telegram and sets up C2 infrastructure with TLS. Both tools demonstrate EncryptHub's shift towards stealthier, resilient tactics.
Additional Tactics Used by EncryptHub
The experts observed EncryptHub setting up a fake video call platform, RivaTalk, as cover for its new C2 server. The site, registered in July 2025, requires an access code to download its malicious Windows app, limiting exposure to targets.
The installer abuses a Symantec ELAM binary to sideload a DLL, which runs a PowerShell script pulling further payloads. While showing a fake setup pop-up, it generates fake web traffic to mask activity, then maintains C2 contact, executing AES-encrypted commands for full control.
Conclusion and Recommendations
"The EncryptHub threat actor represents a well-resourced and adaptive adversary, combining social engineering, abuse of trusted platforms, and the exploitation of system vulnerabilities to maintain persistence and control," concludes the report. "Their use of fake video conferencing platforms, encrypted command structures, and evolving malware toolsets underscores the importance of layered defense strategies, ongoing threat intelligence, and user awareness training."
"As their campaigns grow more targeted and stealthier, proactive detection and swift incident response are critical in mitigating the risks posed by this emerging threat group," adds the report. "Followers should take immediate action to patch the MSC EvilTwin vulnerability and implement robust security measures to prevent similar attacks."