Attackers Exploit Samsung MagicINFO Flaw to Compile a Cryptominer on a Victim Endpoint
Summary
Huntress describes attackers exploiting a Samsung MagicINFO flaw, installing AnyDesk, creating a local admin account, disabling Defender, and compiling a Monero miner on the endpoint.
Key points
- Attackers reportedly exploited CVE-2025-4632 in Samsung MagicINFO to gain system-level access.
- They made repeated attempts to download AnyDesk, then created a local administrator account and disabled Microsoft Defender.
- A Silent XMR Miner builder launched .NET utilities and several C compilers to build the miner directly on the victim endpoint.
- The miner connected to C3Pool to mine Monero using the host's CPU and potentially GPU.
- Huntress recommends promptly patching internet-facing MagicINFO deployments and monitoring repeated remote-access-tool downloads and unusual compiler activity.
Article Details
- Attack Vectors
- Exploitation of CVE-2025-4632 in Samsung MagicINFO to write an arbitrary file with system authority.
- Repeated downloads and installation of a rogue AnyDesk instance for remote access.
- Creation of a local administrator account and disabling Microsoft Defender protections.
- Execution of a cryptominer builder that compiled the miner directly on the victim endpoint.
- Defensive Notes
- Promptly patch internet-facing Samsung MagicINFO deployments.
- Treat repeated remote-access-tool downloads as a potential sign of compromise.
- Monitor for unusual compiler activity and miner-building behavior, not only known miner binaries.
- Investigate mining-related command-line arguments running under explorer.exe.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 194[.]87[.]89[.]30 | Download source used to deliver the rogue AnyDesk executable. |
| SHA256 | 0d202e16408770e8b6cceb14e1e3e72946b154bf881d27fe33d0060315b30dd1 | SHA-256 hash identified in the article for the cryptominer. |
MITRE ATT&CK
T1055 · Process InjectionThe article interprets mining arguments running under explorer.exe as suggesting a malicious process injected into that process.T1105 · Ingress Tool TransferThe actor attempted to download AnyDesk from 194.87.89[.]30 using certutil.exe and PowerShell.T1136.001 · Local AccountThe actor created the local account oldadministrator with administrator privileges.T1190 · Exploit Public-Facing ApplicationThe actor reportedly exploited a vulnerability in internet-facing Samsung MagicINFO for initial access.T1219 · Remote Access ToolsThe actor installed a rogue AnyDesk instance for remote access.T1496 · Resource HijackingThe cryptominer used the victim host's CPU, and potentially GPU, to mine Monero.T1562.001 · Disable or Modify ToolsThe actor disabled Microsoft Defender protections.
CVE
CVE-2024-7399file as system authority. This vulnerability was fixed in May 2025 (after an initial, earlier flaw CVE-2024-7399 was found to have an incomplete fix). In reporting the incident, the customer was informed ofCVE-2025-4632In this incident, the activity was reportedly associated with CVE-2025-4632, a Samsung MagicINFO vulnerability enabling attackers to write an arbitrary file as system authority. This vulnerability was fixed in May 2025
People
Malware
Vendors
Products
AnyDeskAttackers then deployed a rogue AnyDesk instance (after three tries), created a new local admin account, and disabled Defender protections.Microsoft DefenderHowever, this command was quickly removed by Microsoft Defender on the endpoint.Samsung MagicINFOThe incident started with exploitation of a known Samsung MagicINFO flaw.Windows DefenderFigure 4: Using SystemSettingsAdminFlows.exe to disable Windows Defender
Tools
Donutbeing executed, followed by multiple instances of several different C compilers being run, including donut.exe, tcc.exe, and MinGW64 cc1.exe and gcc.exe. Donut is described as "a position-independent code thatMinGW64by multiple instances of several different C compilers being run, including donut.exe, tcc.exe, and MinGW64 cc1.exe and gcc.exe. Donut is described as "a position-independent code that enables in-memory executionSilent XMR Miner Builder.exein this incident compiled the cryptominer directly on the endpoint. They ran commands via Silent XMR Miner Builder.exe (a Windows builder for deploying a Monero, or XMR, cryptominer, commonly associated with theTcc.exefollowed by multiple instances of several different C compilers being run, including donut.exe, tcc.exe, and MinGW64 cc1.exe and gcc.exe. Donut is described as "a position-independent code that enables