Water Gamayun Weaponizes “MSC EvilTwin” Zero-Day for Stealthy Backdoor Attacks

A new cyber espionage campaign by the Russia-aligned APT group Water Gamayun has been uncovered, exploiting a zero-day vulnerability (CVE-2025-26633) in Windows' Microsoft Management Console (MMC). The attack begins with victims being redirected to a malicious domain while searching for business solutions, leading to the download of a disguised malware payload. The exploit allows attackers to inject malicious code into mmc.exe, bypassing security detections.

The campaign aims at strategic intelligence gathering and credential theft, showcasing high operational security standards. Zscaler attributes this campaign to Water Gamayun, known for supply-chain attacks and zero-day exploitation.