Attackers build “silent” cryptominer on victim’s machine and give themselves away

Huntress researchers detailed an attack in which a threat actor exploited CVE-2025-4632, a file-write vulnerability in Samsung MagicINFO digital signage software, to gain system-level access. After multiple failed attempts, the attacker installed AnyDesk, created a hidden admin account, disabled Microsoft Defender, and used a tool derived from the open-source SilentXMRMiner project to compile a Monero cryptominer directly on the victim's machine. The compilation process itself, involving .NET utilities and C compilers running under an unsigned program, generated unusual telemetry that tipped off defenders despite the miner disguising itself as Windows Explorer. Huntress recommends patching internet-facing MagicINFO deployments, treating repeated remote-access-tool download attempts as compromise indicators, and monitoring for unexpected compiler activity.

Source: https://www.itsecurityguru.org/2026/09/25/attackers-build-silent-cryptominer-on-victims-machine-and-give-themselves-away. 8 Sync News only summarizes and links out; content copyright belongs to the authors and original sources.