CTI · reviewed · 2026-09-25

Threat actor compiles cryptominer on endpoint via Samsung MagicINFO flaw

Full story & timeline

Actors

—

Malware / tools

Silent XMR Miner

Campaigns

—

CVEs

CVE-2025-4632

Victim sectors

digital-signagetechnology

Geography

—

MITRE ATT&CK

T1190 Exploit Public-Facing Application Initial Access
T1105 Ingress Tool Transfer Command and Control
T1136 Create Account Persistence
T1562 Impair Defenses Stealth
T1500 Compile After Delivery Stealth
T1059 Command and Scripting Interpreter Execution

Indicators

No curated indicators tied to this case.

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: Suspicious Child Processes of Samsung MagicINFO Tomcat
id: 13492049-498b-4c32-871d-4b973f6cd8ab
status: experimental
description: >
    Detects post-exploitation activity of CVE-2025-4632 against Samsung
    MagicINFO 9 Server: every observed step ran as a child of
    tomcat9.exe — certutil and PowerShell pulling AnyDesk from
    194.87.89.30:8899, and compiler tooling (csc.exe, cvtres.exe,
    tcc.exe, cc1.exe, gcc.exe, donut.exe) building a Monero miner on
    the host — plus explorer.exe launched with RandomX mining
    arguments targeting auto.c3pool.org:19999 (Huntress, September
    2026).
references:
    - https://www.huntress.com/blog/threat-actor-compiles-cryptominer
    - https://www.huntress.com/blog/post-exploitation-activities-observed-from-samsung-magicinfo-9-server-flaw
author: Tia N. List
date: 2026/09/25
tags:
    - attack.t1190
    - attack.t1105
    - attack.t1500
    - attack.t1059
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\tomcat9.exe'
    selection_child:
        Image|endswith:
            - '\certutil.exe'
            - '\powershell.exe'
            - '\anydesk.exe'
            - '\csc.exe'
            - '\cvtres.exe'
            - '\tcc.exe'
            - '\cc1.exe'
            - '\gcc.exe'
            - '\donut.exe'
    selection_miner:
        Image|endswith: '\explorer.exe'
        CommandLine|contains: 'c3pool.org'
    condition: (selection_parent and selection_child) or selection_miner
falsepositives:
    - Legitimate administrative use of certutil, PowerShell or AnyDesk on a MagicINFO host
    - Benign compiler invocations under the MagicINFO Tomcat process during vendor maintenance
level: high

YARA-X raw

rule MagicInfo_OnHost_Compiled_XMR_Miner {
    meta:
        author = "Tia N. List"
        date = "2026-09-25"
        status = "experimental"
        description = "Monero miner compiled on the victim host after CVE-2025-4632 exploitation of Samsung MagicINFO 9 Server: Silent XMR Miner Builder drives csc.exe/cvtres.exe/tcc.exe/cc1.exe/gcc.exe on the host, and the launched miner carries RandomX flags pointing at the c3pool mining gateway. The incident sample hashes to 0d202e16408770e8b6cceb14e1e3e72946b154bf881d27fe33d0060315b30dd1. Derived from case analysis (Huntress) — NOT validated against a live sample."
        reference = "https://www.huntress.com/blog/threat-actor-compiles-cryptominer"
        falsepositives = "Other Monero miners configured against the public c3pool gateway; combine with the tomcat9.exe process tree before acting"
    strings:
        $c2a = "auto.c3pool.org" ascii nocase
        $c2b = "194.87.89.30" ascii
        $c2c = "185.225.226.53" ascii
        $m1 = "Silent XMR Miner Builder" ascii nocase
        $m2 = "oldadministrator" ascii nocase
        $m3 = "F@x2020!@#" ascii
        $m4 = "rx/0" ascii
        $m5 = "donut.exe" ascii nocase
    condition:
        uint16(0) == 0x5a4d and ((any of ($c2*) and any of ($m*)) or 3 of ($m*))
}

References

Source on GitHub