Huntress Details Post-Exploitation Activity Targeting Samsung MagicINFO 9
Summary
Huntress observed three incidents involving exploitation of Samsung MagicINFO 9. Attackers attempted to install services using downloaded executables; one host showed execution evidence. Huntress advises keeping servers off the internet until a patch is available.
Key points
- Huntress verified a public proof of concept against Samsung MagicINFO 9 versions 21.1050.0 and 21.1040.2 and observed exploitation in the wild.
- Among more than 75 customer machines with MagicINFO installed, Huntress identified three incidents involving the vulnerability.
- Two incidents shared identical commands and the same backdoor email and password, and occurred within about 40 minutes; the third occurred the following day.
- Commands included reconnaissance with whoami and arp -a, and attempts to install services using downloaded executables renamed as php-cli.exe and php-fpm.exe.
- Event logs showed service-installation attempts that failed on one host; EDR data showed downloaded binaries executing on another.
- Huntress said there was no patch at the time of publication and recommended keeping MagicINFO servers off the internet.
Article Details
- Attack Vectors
- Attackers exploited the Samsung MagicINFO 9 Server vulnerability using a publicly available proof of concept; Huntress observed exploitation affecting versions 21.1050.0 and 21.1040.2.
- Attackers downloaded executables from a staging website, renamed them on victim machines, and attempted to install them as Windows services.
- Two related incidents used the same backdoor email address and password. Reconnaissance commands included `whoami` and `arp -a`.
- Defensive Notes
- Huntress recommended keeping servers running MagicINFO off the internet because no patch was available at the time of reporting.
- The article suggests firewalls may have limited exposure to this attack.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | abd4afd71b3c2bd3f741bbe3cec52c4fa63ac78d353101d2e7dc4de2725d1ca1 | Hash listed in the article's IOC table alongside the attacker-installed php-fpm.exe executable. |
| SHA256 | c9c464c872b539eee7481e15331b7a6c75f4ba1f24b64d9f36a70b87a164d122 | Hash listed in the article's IOC table for srvany.exe, an executable used by the attacker. |
| URL | hxxp[:]//185[.]225[.]226[.]53/php_cli.exe | URL of an executable used by the attacker, according to the article's IOC table. |
| URL | hxxp[:]//185[.]225[.]226[.]53/srvany.exe | URL of an executable used by the attacker, according to the article's IOC table. |
MITRE ATT&CK
T1036 · MasqueradingAttackers renamed downloaded executables, including srvany.exe as php-cli.exe and php_cli.exe as php-fpm.exe; the article says the purpose may have been obfuscation but is unclear.T1046 · Network Service DiscoveryThe attacker ran `arp -a` to inspect hosts on the victim's local network.T1543.003 · Windows ServiceThe attacker attempted to install executables as Windows services, including a service named PHP5.3.8.