Water Gamayun
aka EncryptHub, LARVA-208
A group reported by Trend Micro that steals information to make money. It abused an unpatched flaw in a Windows management tool to pull passwords and other data from corporate computers.
- Alert level
- 2/ 5
- Reports & advisories (90 days)
- 0
- Known exploited CVEs
- 1
- Personal data leaked (disclosed)
- None confirmed
Attribution
- Described as a Russian threat actor — Trend Micro
Exploited vulnerabilities and targeted products
If you run any of these products, first make sure they are updated to a fixed version.
How they attack
Entry
Handing out fake software
Like handing out products in a famous brand's wrapping paper with the contents swapped.
Inside
A look-alike twin file
Like placing a fake document with the same name on a nearby shelf so the clerk picks up the fake first.
Goal
Stealing passwords and data
Like sweeping up the key rings and notes from every desk drawer.
Sources
Attributions are quoted as assessed by governments and security vendors. VulnPulse does not make attributions itself.
Leak counts only add up figures disclosed by the affected companies or authorities, never the attackers' own claims. We do not list victim names or link to leak sites.
The alert level is calculated automatically from reports and advisories in the last 90 days, known exploited vulnerabilities, and whether the group has targeted Japan.
Updated 2026-10-23 · daily