CVE-2025-26633: Microsoft MMC -- Zero-Day Security Feature Bypass

Background

Microsoft Management Console (MMC) hosts Windows administrative snap-ins — Event Viewer, Device Manager, Group Policy Editor, and hundreds of third-party management tools. MMC files (.msc) are executable in the sense that opening them runs the snap-in they reference, and malicious .msc files have served as attack vectors in the past.

CVE-2025-26633 was patched in March 2025 and confirmed as actively exploited before the fix. Trend Micro attributed exploitation to EncryptHub (also tracked as LARVA-208 and Water Gamayun), a threat actor focused on multi-stage malware delivery. The bypass is designed to evade the Windows security checks that would normally warn users about potentially dangerous files.

Technical Mechanism

When MMC opens a .msc file, Windows applies security checks — including SmartScreen and Mark of the Web (MotW) checks — to determine whether to warn the user. CVE-2025-26633 exploits a flaw in how MMC handles certain .msc file structures or associated metadata, causing those checks to be skipped.

The bypass works through a crafted .msc file that manipulates how MMC resolves custom snap-in paths or resources:

1. A malicious .msc file references a specially constructed MMC snap-in
2. When MMC processes the file, the security check that should flag it as dangerous is bypassed
3. MMC executes the referenced snap-in or payload without displaying a warning
4. The payload — in EncryptHub’s campaigns, typically a downloader — executes silently

Users see nothing out of the ordinary. The .msc file may appear to be a legitimate management tool.

Real-World Exploitation Evidence

Trend Micro’s research on EncryptHub campaigns identified this zero-day:

• EncryptHub (LARVA-208 / Water Gamayun) — a financially motivated threat actor using sophisticated phishing campaigns and living-off-the-land techniques
• Multi-stage malware delivery — the MMC bypass was used to deliver a downloader, which then retrieved secondary payloads including remote access trojans and information stealers
• Phishing delivery — malicious .msc files delivered via phishing emails, sometimes disguised as legitimate management tools
• EncryptHub Stealer — the actor’s custom information stealer, harvesting credentials and browser data
• Rhadamanthys / SilentPrism — additional payloads observed in EncryptHub campaigns leveraging this vulnerability

The targeting was broad rather than narrowly focused, suggesting opportunistic access across multiple target types.

Impact Assessment

• Malware execution without security warning — users see no SmartScreen/security warning
• Credential theft — EncryptHub Stealer and Rhadamanthys harvest stored credentials, cookies, and crypto wallet data
• Remote access — RAT payloads maintain persistent access to compromised systems
• Supply chain potential — if a threat actor can compromise an admin who regularly uses .msc files, the impact is significantly elevated
• Trusted file type abuse — .msc files are used by IT administrators; blocking them broadly is often not feasible in managed enterprise environments

Affected Versions

Remediation Steps

1. Apply March 2025 Patch Tuesday updates
2. If .msc files are received via email or downloaded from the internet, configure email gateway to quarantine them:
   • .msc files have very limited legitimate use in email attachments
3. Deploy AppLocker or WDAC rules to restrict MMC to loading only approved snap-ins:

   # AppLocker publisher rule for legitimate MMC snap-ins
   # Block unsigned or non-whitelisted .msc files from running

4. Monitor for EncryptHub IOCs on endpoints:
   • Check threat intel feeds for current EncryptHub infrastructure hashes and IPs
5. Enable PowerShell script block logging and AMSI logging to detect post-exploitation activity

Detection Guidance

File monitoring — alert on .msc files:

• Downloaded from the internet (MotW tagged)
• Received as email attachments
• Located in unusual directories (temp, downloads, user profile)

Process monitoring — look for mmc.exe executing with unusual parameters or spawning unexpected child processes:

process_name = "mmc.exe" AND (
  child_process_name IN ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe") OR
  parent_process_name NOT IN ("explorer.exe", "mmc.exe")
)

Windows Event Logs:

• Event ID 4688: Process creation with mmc.exe as parent to unexpected children
• AppLocker events if block rules are in place

Suricata signature:

alert http any any -> any any (msg:"Possible EncryptHub/CVE-2025-26633 Payload Delivery"; flow:established,from_server; file.data; content:"MZ"; offset:0; depth:2; file.name; content:".msc"; endswith; classtype:web-application-attack; sid:2034024; rev:1;)

Timeline

References

• NVD — CVE-2025-26633
• CISA KEV — CVE-2025-26633
• Microsoft MSRC — CVE-2025-26633