Hackers Used a Samsung Flaw to Build a Cryptominer Inside Victim Systems
Huntress says attackers used Samsung MagicINFO CVE-2025-4632 on one Windows host to compile a Monero miner.
Huntress investigated one managed Windows endpoint where intruders used CVE-2025-4632, a MagicINFO file-write flaw that can grant system privileges, after Samsung's May 2025 fix for an incomplete patch of CVE-2024-7399. After Defender blocked two download attempts, the attackers installed AnyDesk, created a local administrator account, and disabled Microsoft Defender. They then ran an unsigned SilentXMRMiner builder that compiled a Monero miner on the host, which later contacted the c3pool mining pool. Huntress describes a single endpoint rather than a measured multi-organization campaign and urges patching internet-facing MagicINFO servers.
- Entry used MagicINFO CVE-2025-4632, related to an incomplete CVE-2024-7399 fix.
- Intruders installed AnyDesk, added an admin account, and disabled Defender.
- An unsigned builder compiled a Monero miner on the victim host.
- Huntress observed one endpoint, not a broad measured campaign.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1219 Remote Access SoftwareT1136.001 Local AccountT1562.001 Disable or Modify ToolsT1496 Resource Hijacking
- Malware
- SilentXMRMiner
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-7399 | Unauthenticated Path Traversal File Write in Samsung MagicINFO 9 Server | 9.8 | 92% | KEV | KEV |
| CVE-2025-4632 | Actively Exploited Path Traversal File Write in Samsung MagicINFO 9 Server | 9.8 | 24% | KEV | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | auto.c3pool.org | ownload address shown in the attack commands. Mining domain auto.c3pool.org Public mining pool contacted by the miner. Mining endpoint |
| ipv4 | 194.87.89.30 | f compromise (IoCs):- Type Indicator Description IP address 194.87.89[.]30 Source used to download AnyDesk. URL http://194.87.89.30: |
| sha256 | 0d202e16408770e8b6cceb14e1e3e72946b154bf881d27fe33d0060315b30dd1 | xe Cryptominer identified in the source’s IoC list. SHA-256 0d202e16408770e8b6cceb14e1e3e72946b154bf881d27fe33d0060315b30dd1 Hash of x.exe . File anydesk.exe / AnyDesk.exe Remote acces |
From the original article
4 min read at cybersecuritynews.com
Attackers broke into a Windows system through a known flaw in Samsung’s MagicINFO software, then built a cryptocurrency miner on the compromised machine. Rather than arriving as a finished program, the miner was assembled there, leaving an unusual activity trail. The case began in early September 2026 with an alert tied to MagicINFO Premium, software […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.