Threat actorcritical
The controversial case of the threat actor EncryptHub
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2025-24061+1 related CVE | Protection mechanism failure in Windows Mark of the Web (MOTW) allows an unauthorized attacker to bypass a security feature locally | 7.8 group max | 1% | ||
CVE-2025-26633+1 related CVE | Local Security Feature Bypass in Microsoft Windows Management Console (MMC) | 7.0 | 30% | KEVRansomwarePoC ×2 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | xss.is | selling some of his exploits on the Russian speaking forum xss[.]is. To do so, first he asked ChatGPT which CVEs were related |
From the original article
3 min read at securityaffairs.com
Microsoft credited controversial actor EncryptHub, a lone actor with ties to cybercrime, for reporting two Windows flaws. Microsoft credited the likely lone actor behind the EncryptHub alias (also known as SkorikARI) for reporting two Windows security flaws, highlighting a “conflicted” figure balancing ethical cybersecurity work with cybercriminal activity.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.