The Not So Silent Miner: Threat Actor Compiles Cryptominer on the Endpoint

Huntress observed exploitation of a Samsung MagicINFO vulnerability (CVE-2025-4632) that enabled an attacker to install AnyDesk, create a local admin account, disable Defender, and compile and run a Monero cryptominer on the compromised endpoint; the report includes command lines, process/EDR telemetry, and IOCs (download IP 194.87.89.30, password F@x2020!@#, miner SHA256, account oldadministrator) and recommends patching, monitoring repeated RMM downloads, and detecting unusual compiler activity.