EncryptHub
EncryptHub is a financially motivated Russian threat actor, also tracked as LARVA-208 and Water Gamayun. The content also describes Water Gamayun as a Russia-aligned APT and attributes the same activity cluster to EncryptHub/LARVA-208. EncryptHub has been linked to malware campaigns, credential theft, and access brokering, and gained prominence in mid-2024. The actor has targeted Web3 developers, enterprise and government networks, and organizations in sectors including telecom, finance, defense, and manufacturing. Reporting in the content states that at least 618 organizations worldwide were compromised in campaigns attributed to EncryptHub. The actor has also abused Steam to distribute malware by compromising game titles such as Chemia. Observed tradecraft includes social engineering, spear-phishing, smishing, vishing, fake IT-support interactions over Microsoft Teams, videoconferencing lures, fraudulent login pages impersonating Microsoft 365, Cisco AnyConnect, and other corporate VPN services, and the use of remote monitoring and management tools such as AnyDesk and TeamViewer for access and lateral movement. The actor has repeatedly exploited the Windows Microsoft Management Console vulnerability CVE-2025-26633 ("MSC EvilTwin") using rogue or paired benign/malicious .msc files to trigger code execution. Related activity includes abuse of compromised or trusted platforms such as Brave Support, use of deceptive paths such as "C:\Windows \System32", PowerShell-based multi-stage loaders, persistence, AES-encrypted tasking, SOCKS5 proxy tunneling, DLL sideloading via a legitimate Symantec ELAM binary, and use of built-in administrative tools for lateral movement. Malware and tooling directly associated in the content include Fickle Stealer, SilentPrism, DarkWisp, SilentCrystal, a Golang-based SOCKS5 backdoor, Rhadamanthys, Stealc, HijackLoader, and Vidar. In the Chemia Steam case, EncryptHub added HijackLoader, which downloaded Vidar, and also deployed its custom Fickle Stealer, which steals credentials, browser data, cookies, and cryptocurrency wallets. Other reporting in the content states the actor used PowerShell scripts to deliver Rhadamanthys, Stealc, and Fickle Stealer, and exfiltrated cryptocurrency wallet data, VPN client configuration data, password manager data, and files matching selected extensions and keywords. A custom PowerShell-based data encryptor is also mentioned. The content references a Larva-148 subgroup in connection with EncryptHub activity, with analysis suggesting it may supply domains and phishing kits.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
19 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
10 malware families attributed to this actor across reporting.
5 additional families tracked in Mallory.
Associated vulnerabilities
1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.
Observables
18 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Used malicious Steam-hosted game content to deliver malware for credential theft, browser data theft, cookie theft, and cryptocurrency wallet theft.
Financially motivated group targeting Web3 developers using fake AI platforms and social engineering lures to deploy stealer malware and harvest data from cryptocurrency wallets. The content also notes the group has a history of deploying ransomware.
Referenced only as an associated analytic story; no specific threat actor activity, targeting, malware, or operations are described in the content.
Financially motivated actor using a mix of social engineering and exploitation (notably CVE-2025-26633 / MSC EvilTwin) to deliver stealer malware (e.g., Fickle Stealer) and target Web3 developers via fake AI platforms.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.