Reported by 5 outlets
Threat actor compiles cryptominer on endpoint via Samsung MagicINFO flaw
Why this score
- Breadth
- 2.00 / 2.0 · 5 sources
- Authority
- 1.00 / 2.0 · best outlet weight
- Severity
- 5.00 / 5.0 · CVSS + KEV signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
Huntress documented an intrusion, detected early September 2026 on a Samsung MagicINFO Premium digital signage server, where the attacker used the year-old CVE-2025-4632 path traversal (CWE-22, CVSS 9.8, arbitrary file writes with SYSTEM authority, fixed in May 2025 in MagicINFO 9 Server 21.1052) and then did something unusual: instead of dropping a miner binary, they compiled one on the endpoint. Process evidence shows activity through tomcat9.exe, the Apache Tomcat service MagicINFO runs under. The attacker tried three times to fetch AnyDesk from 194.87.89[.]30, lost twice to Defender (certutil.exe, then PowerShell Invoke-WebRequest), succeeded on the third attempt, installed AnyDesk with a set password, created a local account named oldadministrator, and used SystemSettingsAdminFlows.exe to disable Defender. A second alert followed eight days after the first, tied to the same access route, with the Monero miner built via the SilentXMRMiner toolchain whose compile burst stands out in telemetry.
The chain's history explains why unpatched servers keep falling. An independent researcher via SSD Secure Disclosure disclosed the unauthenticated arbitrary file upload in the /MagicInfo/servlet/SWUpdateFileUploader servlet in early 2025 after Samsung missed the 90-day window, Huntress verified the public PoC still worked against 21.1050.0 and 21.1040.2, CISA added the CVE to KEV on May 22, 2025 with a June 12 federal deadline, and May 2025 incidents among Huntress customers saw actors deploy PHP service persistence (the PHP5.3.8 LocalSystem service) from 185.225.226[.]53 across more than 75 machines with MagicINFO installed.
The ongoing exploitation a full sixteen months after the May 2025 fix says internet-facing MagicINFO remains under continuous automated attack. Confirm version 21.1052 or later, take the server off the public internet, and hunt for the tells this case provides: unexpected compilers or build activity on signage hosts, AnyDesk fetches and installs, the oldadministrator account, SystemSettingsAdminFlows.exe Defender tampering, and Event IDs 7045 and 7000 for new services.
Timeline
-
original reporting
(huntress.com) Compiling Cryptominers On-Endpoint: A Novel Approach Leveraging Samsung MagicINFO Vulnerabilities and SilentXMRMiner In brief
www.huntress.com · 19d ago · September 24th, 2026
(huntress.com) Compiling Cryptominers On-Endpoint: A Novel Approach Leveraging Samsung MagicINFO Vulnerabilities and SilentXMRMiner In brief
via Mastodon https://www.huntress.com/blog/threat-actor-compiles-cryptominer
-
update from ssd-disclosure.com
SSD Advisory - Samsung MagicINFO Unauthenticated RCE
ssd-disclosure.com · 532d ago · April 30th, 2025
An independent researcher working with SSD Secure Disclosure published an unauthenticated arbitrary file upload in Samsung MagicINFO 9 Server 21.1050.0 via the /MagicInfo/servlet/SWUpdateFileUploader endpoint, where a path-traversable fileName parameter allowed a JSP web shell and remote code execution under Apache Tomcat. SSD notified Samsung on 12 January 2025, received a duplicate notice, and released the advisory with a working curl proof of concept against port 7002 after its 90-day window and grace period expired. This is the original researcher disclosure in the chain that Samsung later assigned SVE-2025-50001 / CVE-2025-4632.
-
update from huntress.com
Rapid Response: Samsung MagicINFO 9 Server Flaw
huntress.com · 525d ago · May 7th, 2025
Huntress independently verified that the then-latest MagicINFO 9 Server versions 21.1050.0 and 21.1040.2 were still exploitable with the public SSD Disclosure proof of concept, concluding the August 2024 patch for the earlier CVE-2024-7399 was incomplete or covered a separate flaw. The post reported exploitation already occurring in the wild, cited Arctic Wolf's observation of exploitation, and noted a Mirai botnet variant exploiting the flaw tracked by the SANS ISC. Huntress advised keeping MagicINFO 9 Server off the internet until a proper fix shipped.
-
update from huntress.com
Post-Exploitation Activities Observed from the Samsung MagicINFO 9 Server Flaw
huntress.com · 523d ago · May 9th, 2025
Days after the proof of concept went public, Huntress documented three exploitation incidents beginning 2025-05-04 among more than 75 customer machines with MagicINFO installed. Attackers downloaded php_cli.exe and srvany.exe from 185.225.226[.]53 and registered a LocalSystem service named PHP5.3.8 under C:\MagicInfo Premium\tomcat\bin for persistence. The post points to System event log Event IDs 7045 and 7000 as detection anchors and lists SHA256 hashes for the dropped binaries.
-
update from nvd.nist.gov
CVE-2025-4632 Detail
nvd.nist.gov · 519d ago · May 13th, 2025
NVD published CVE-2025-4632, a CWE-22 path traversal in Samsung MagicINFO 9 Server before 21.1052 that lets attackers write arbitrary files with system authority, scored 9.8 CRITICAL by both NVD and CNA Samsung. The record references Samsung's SVP-MAY-2025 security update (SVE-2025-50001) as the vendor advisory and fix. The page also flags the CVE as present in CISA's Known Exploited Vulnerabilities catalog.
-
update from cisa.gov
Samsung MagicINFO 9 Server Path Traversal Vulnerability (CISA KEV)
cisa.gov · 510d ago · May 22nd, 2025
CISA added CVE-2025-4632 to the Known Exploited Vulnerabilities catalog on 22 May 2025 under the entry name Samsung MagicINFO 9 Server Path Traversal Vulnerability, with a required-action due date of 12 June 2025 for federal civilian agencies under BOD 22-01. KEV listing confirms the vulnerability was known to be exploited in the wild at the time of addition.
-
update from www.huntress.com
New. "Huntress recently observed a threat actor doing something unique post-compromise: instead of simply dropping a miner, they compiled on
www.huntress.com · 19d ago · September 24th, 2026
New. "Huntress recently observed a threat actor doing something unique post-compromise: instead of simply dropping a miner, they compiled on
via Mastodon https://www.huntress.com/blog/threat-actor-compiles-cryptominer
-
update from cyberpress.org
Samsung MagicINFO Flaw Used to Deploy AnyDesk and Compile Stealthy Cryptominer Payloads
cyberpress.org · 18d ago · September 25th, 2026
Attackers exploited a known Samsung MagicINFO flaw to install remote-access software and build a Monero cryptominer directly on a victim’s Windows endpoint. The unusual build process created a burst of activity that made the attack easier to spot in endpoint telemetry. Huntress detected the activity in early September 2026 on a system running Samsung MagicINFO Premium, software used to manage digital signage. The endpoint generated another alert eight days after the first incident report. Huntress tied the new activity to the same access route. Process evidence showed commands running through tomcat9.exe , the Apache Tomcat service used by MagicINFO, helping analysts trace the activity back to the compromised application. MagicINFO Flaw Fuels Cryptomining The attacker tried three times to download AnyDesk from 194.87.89[.]30 . Microsoft Defender blocked the first attempt, which used certutil.exe , and the second, which used PowerShell’s Invoke-WebRequest . The third attempt succeeded. The attacker installed AnyDesk, set a password, and created a local account named oldadministrator using the same password. Detection of AnyDesk being downloaded (Source: huntress)
-
update from www.huntress.com
Why drop a malware binary when you can compile it directly on the victim's machine? @ huntress recently investigated an intrusion where an a
www.huntress.com · 16d ago · September 27th, 2026
Why drop a malware binary when you can compile it directly on the victim's machine?