EncryptHub

EncryptHub is a malware-associated cybercriminal persona/tooling name linked to malware campaigns, credential theft, and access brokering. The content identifies EncryptHub as part of the malware arsenal associated with Water Gamayun, a Russia-aligned threat group known for targeting enterprise and government networks with objectives including sensitive data exfiltration, credential harvesting, and persistence. In one reported campaign, the final payload could not be confirmed because command-and-control infrastructure was non-responsive, but EncryptHub was listed among the plausible malware families that may have been deployed alongside SilentPrism, DarkWisp, and Rhadamanthys. Separate reporting cited by the content states that EncryptHub relied on the MSC EvilTwin loader exploiting CVE-2025-26633. The content also describes EncryptHub as a persona tied to spoofed WinRAR websites, malware distribution, credential theft, and access brokering, and notes aliases SkorikARI and LARVA-208. It further claims this actor compromised hundreds of high-value targets across Europe and Asia. High-confidence indicators directly mentioned in the content include the association with MSC EvilTwin loader exploitation of CVE-2025-26633 and use in campaigns involving spoofed WinRAR websites.