SilentCrystal

SilentCrystal is a Golang-compiled loader associated with the Russian financially motivated threat actor EncryptHub, also tracked as LARVA-208 and Water Gamayun. It has been observed in campaigns exploiting the Windows Microsoft Management Console vulnerability CVE-2025-26633 ("MSC EvilTwin") as part of multi-stage intrusion chains that combine social engineering with technical exploitation. Researchers described SilentCrystal as part of EncryptHub’s shift toward stealthier and more resilient tooling.

SilentCrystal abuses Brave Support, a legitimate Brave browser support platform, to host next-stage malware. It sends a POST request to a command-and-control server using a hardcoded API key and a randomly generated .zip filename; the server responds with a Brave Support link to a ZIP archive containing weaponized .msc files used in the CVE-2025-26633 attack chain. Trustwave assessed the actor likely had unauthorized access to a Brave Support account with file-upload permissions. SilentCrystal also creates a deceptive directory path, "C:\Windows \System32," using a trailing space after "Windows," and replaces a {URI} placeholder inside a WF.msc file with a malicious C2 URL before triggering execution via the CVE-2025-26633 behavior.

The malware has been described as mirroring functionality previously implemented in PowerShell scripts used by the group to deploy malicious .msc files. In the broader observed campaigns, EncryptHub used Microsoft Teams and fake IT-support or videoconferencing lures to initiate infection, with downstream payloads including PowerShell scripts for reconnaissance, persistence, C2 communications, and delivery of additional malware such as Fickle Stealer. SilentCrystal itself is specifically identified as the Go-based loader stage used to retrieve and prepare the malicious payload archive for this exploitation chain.