What Happened

Trend Micro disclosed CVE-2025-26633, a security feature bypass in Microsoft Management Console (MMC) patched in March 2025 Patch Tuesday. The vulnerability allows attackers to craft .msc snap-in files that bypass Windows file reputation checking (SmartScreen) and Mark-of-the-Web (MotW) protections.

Water Gamayun (also tracked as UAT-5647, EncryptHub) exploited this zero-day to deliver SilentPrism and DarkWisp backdoors.

Technical Details

The bypass exploits how MMC processes .msc files loaded via custom console configurations. By embedding a malicious payload in an MSC file's XML structure, attackers bypass the expected security zone checks, executing arbitrary code under the MMC process context.

Attack Vector

Observed delivery methods:

  • Phishing emails with .msc attachments disguised as admin tools
  • Malicious links pointing to WebDAV shares hosting .msc files
  • GitHub repositories with "admin utilities"

Recommended Actions

  1. Apply March 2025 Patch Tuesday updates
  2. Create AppLocker or WDAC rules blocking .msc files from user-writable paths
  3. Monitor for mmc.exe spawning unusual child processes (PowerShell, cmd, wscript)
  4. Block WebDAV access at perimeter if not required
  5. Enable Attack Surface Reduction rule: Block execution of potentially obfuscated scripts