The Not So Silent Miner: Threat Actor Compiles Cryptominer on the Endpoint
Huntress details attackers exploiting Samsung MagicINFO CVE-2025-4632 to install AnyDesk and compile an XMR cryptominer directly on the endpoint.
Huntress documented an incident where a threat actor gained initial access by exploiting Samsung MagicINFO CVE-2025-4632 (arbitrary file write as SYSTEM, fixed May 2025), then downloaded AnyDesk via certutil and PowerShell, created a rogue 'oldadministrator' account, and disabled Microsoft Defender. The actor ran Silent XMR Miner Builder.exe, triggering csc.exe, donut.exe, tcc.exe, and MinGW64 compilers to build a Monero miner on the host, which connected to C3Pool under explorer.exe with injected mining arguments.
- Initial access via Samsung MagicINFO CVE-2025-4632 arbitrary file write
- AnyDesk installed after certutil and PowerShell download attempts
- Defender disabled and rogue local admin account created
- Cryptominer compiled on-endpoint via Silent XMR Miner Builder and mined Monero to C3Pool
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1105 Ingress Tool TransferT1136.001 Create Account: Local AccountT1562.001 Impair Defenses: Disable or Modify ToolsT1496 Resource Hijacking
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-7399 | Unauthenticated Path Traversal File Write in Samsung MagicINFO 9 Server | 9.8 | 92% | KEV | KEV |
| CVE-2025-4632 | Actively Exploited Path Traversal File Write in Samsung MagicINFO 9 Server | 9.8 | 24% | KEV | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 194.87.89.30 | took the threat actor three times to download AnyDesk from 194.87.89[.]30 . At first, they tried to use certutil.exe : C:\Windows\S |
| sha256 | 0d202e16408770e8b6cceb14e1e3e72946b154bf881d27fe33d0060315b30dd1 | 2020!@# Password for new user account, AnyDesk x.exe SHA256 0d202e16408770e8b6cceb14e1e3e72946b154bf881d27fe33d0060315b30dd1 Cryptominer oldadministrator Newly created local admin acco |
From the original article
5 min read at huntress.comThreat actors exploited Samsung MagicINFO to install AnyDesk, disable Defender, and compile a Monero miner directly on a victim endpoint. Learn the detection signals.
huntress.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.