Huntress researchers investigated an intrusion that began with exploitation of a Samsung MagicINFO vulnerability, followed by repeated AnyDesk installation attempts, local account creation, and Defender tampering. The attacker then compiled a SilentXMRMiner-based Monero miner directly on the victim endpoint and connected it to C3Pool for mining. #SamsungMagicINFO #AnyDesk #SilentXMRMiner #C3Pool
Keypoints
- The intrusion started through a Samsung MagicINFO flaw, specifically CVE-2025-4632, which allowed arbitrary file write as system authority.
- The attacker repeatedly tried to download and install AnyDesk from 194.87.89[.]30, with some attempts blocked by Microsoft Defender before one succeeded.
- The attack was executed through the Apache Tomcat service used by Samsung MagicINFO, as shown by the tomcat9.exe parent process.
- After installing AnyDesk, the actor created a local user account named oldadministrator and reused the same password for both the account and AnyDesk.
- Microsoft Defender was disabled using SystemSettingsAdminFlows.exe to help maintain access and reduce detection.
- The threat actor compiled a cryptominer on the endpoint using Silent XMR Miner Builder.exe, triggering multiple compiler processes and noisy telemetry.
- The resulting miner connected to C3Pool to mine Monero, using the host’s CPU and potentially GPU, and ran under explorer.exe with mining-specific command-line arguments.
MITRE Techniques
- [T1190 ] Exploit Public-Facing Application – The attacker gained initial access by exploiting Samsung MagicINFO. [‘…exploiting a known Samsung MagicINFO vulnerability…’]
- [T1105 ] Ingress Tool Transfer – The attacker downloaded AnyDesk from a remote server onto the endpoint. [‘…attempts to download the AnyDesk RMM to the endpoint…’]
- [T1059.003 ] Command and Scripting Interpreter: Windows Command Shell – The attacker used cmd.exe to run download and execution commands. [‘…/c certutil -urlcache -split -f…’]
- [T1106 ] Native API – The attacker leveraged built-in Windows tools and system functionality to carry out actions on the endpoint. [‘…using a method involving PowerShell Invoke-WebRequest…’]
- [T1053 ] Scheduled Task/Job – Not explicitly mentioned as scheduled tasks, but if needed: no clear evidence in the article. [‘Not mentioned’]
- [T1547.001 ] Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder – The article indicates persistence through installed remote access software and local account use, but does not explicitly mention this technique. [‘Not mentioned’]
- [T1136.001 ] Create Account: Local Account – The threat actor created a new local user account named oldadministrator. [‘…created a new user account named oldadministrator…’]
- [T1112 ] Modify Registry – The article does not mention registry modification. [‘Not mentioned’]
- [T1562.001 ] Impair Defenses: Disable or Modify Tools – The attacker disabled Microsoft Defender. [‘…disabled Microsoft Defender via SystemSettingsAdminFlows.exe…’]
- [T1027 ] Obfuscated Files or Information – The actor used a builder and multiple compilers to produce the miner on-host, complicating detection. [‘…compiled the cryptominer directly on the endpoint…’]
- [T1127 ] Trusted Developer Utilities Proxy Execution – The attacker ran compiler and utility tools such as csc.exe, cvtres.exe, tcc.exe, and gcc.exe to build the miner. [‘…multiple instances of the .NET Framework utilities csc.exe and cvtres.exe…’]
- [T1496 ] Resource Hijacking – The endpoint was used to mine Monero with CPU and possibly GPU resources. [‘…connected to the C3Pool service… to mine Monero using the host’s CPU, and potentially its GPU…’]
Indicators of Compromise
- [IP address ] Source for AnyDesk download attempts – 194.87.89[.]30
- [File name ] Remote access tool and delivery target – anydesk.exe, Silent XMR Miner Builder.exe
- [File name ] Miner-related binaries and compiler tools observed during build – csc.exe, cvtres.exe, tcc.exe, gcc.exe, donut.exe, cc1.exe
- [File hash ] Cryptominer sample – 0d202e16408770e8b6cceb14e1e3e72946b154bf881d27fe33d0060315b30dd1
- [Domain / service endpoint ] Mining pool used by the miner – auto.c3pool.org:19999
- [Local account name ] Newly created administrator account – oldadministrator
- [Password ] Reused credential for the new account and AnyDesk – F@x2020!@#
Read more: https://www.huntress.com/blog/threat-actor-compiles-cryptominer