Attackers recently leveraged a vulnerability in Samsung’s MagicINFO software to install a cryptominer on a Windows system. The intrusion didn’t use a pre-built miner; instead the attackers assembled the entire miner on the victim’s machine—leaving behavior-based evidence that alerted security experts.
How the Attack Unfolded
The incident was traced to a flaw in MagicINFO Premium, Samsung’s digital signage management tool, identified as CVE-2025-4632. This vulnerability allows an attacker to write files with system privileges, which gave the adversaries an entry point on the affected system. Samsung had patched the issue back in May 2025 following an earlier related flaw, CVE-2024-7399, that had received an incomplete fix.
Once inside, the attacker installed a remote access tool, created a local administrator account, and disabled Microsoft Defender. It was only with defenses weakened that they proceeded to build a Monero miner using the target machine’s resources.
Building the Miner In-Place
Instead of loading a pre-compiled miner, the attacker used Windows development tools and compilers to build the mining binary directly on the compromised system. While this allowed for more customization, it also triggered suspicious compiler activity—one of the few early warnings that defenders have, especially since the final miner was unsigned.
Mining activity was observed using the machine’s CPU and possibly GPU, connecting to a public mining pool. The miners’ tasks were hidden under Windows Explorer processes rather than obvious executables, masking them within legitimate system activity.
The attackers tried three different ways of downloading AnyDesk, a legitimate remote access program, using a download utility and PowerShell—both blocked by Defender—before succeeding on the third attempt. They then used the installation and the custom administrator account to maintain control.
Indicators & Best Practices
Security analysts published multiple indicators of compromise, like the IP address used for downloading AnyDesk, the mining pool domain, the new administrator account (“oldadministrator”) and password, and names of files such as “x.exe” and “Silent XMR Miner Builder.exe.” Included were hashes of malicious files and processes observed during the incident.
To defend against similar attacks, organizations running MagicINFO—especially internet-facing deployments—are urged to apply patches without delay. Monitoring for unexpected compiler invocations, attempts to disable antivirus software, and unauthorized remote access tool installations are critical. Even removing a detected miner is not enough without investigating how access was first obtained and whether it remains.
While this case appears to have involved just one endpoint rather than a widespread campaign, it underscores how a single exposed service can be pivoted into full system compromise.
What this means: Attackers using this approach combine a vulnerable software component, persistence mechanisms, and in-place code generation to evade typical detection. Defenders must shift from signature-based tools alone toward behavior-based monitoring. For organizations deploying MagicINFO or similar tools, maintaining patch discipline, scrutinizing elevated activity and compiling processes, and keeping remote access tightly controlled are essential. The evolving threat shows that old vulnerabilities never fully disappear—they just wait for the right opportunity to be exploited.
