FHN 
Attackers exploited a known flaw in Samsung MagicINFO to gain access to a Windows system and use its resources to mine cryptocurrency.
Instead of downloading a ready-made miner, the attackers built the mining software directly on the compromised computer. This unusual step created activity that security tools could detect.
The incident was discovered in early September 2026 during an investigation of a MagicINFO Premium system. After gaining access, the attackers installed a remote access tool, created an administrator account, disabled Microsoft Defender, and used the machine to mine Monero.
Huntress researchers found the activity while investigating a managed endpoint. The case involved one confirmed system and shows how a vulnerable internet-facing service can lead to long-term access and unauthorized use of computing resources.
Attackers Exploited a MagicINFO Vulnerability
The initial access was linked to CVE-2025-4632, a vulnerability in MagicINFO that allows attackers to write files with system-level privileges.
Samsung released a fix for the flaw in May 2025.
After the initial alert, the customer was advised to address the issue. However, investigators observed new activity eight days later through the same access route.
The attackers attempted to install AnyDesk, a legitimate remote access application, three times.
The first two attempts were blocked by Microsoft Defender. The attackers eventually succeeded and configured a password so they could reconnect to the machine.
They then created a local administrator account and disabled Microsoft Defender, giving themselves a more reliable way to maintain access.
The Miner Was Built on the Infected PC
Once the system was under their control, the attackers launched a Monero miner builder from the user’s Documents folder.
The process started several development tools and C compilers to create the mining software directly on the machine.
This approach helped the attackers avoid simply dropping a finished miner onto the system, but it also created a noticeable trail.
The unsigned builder generated unusual compiler activity that could stand out in endpoint monitoring.
Afterward, investigators observed the miner connecting to a public mining pool and using the compromised system’s computing resources.
The mining activity also appeared to involve Windows Explorer, making the behavior even more suspicious.
What Security Teams Should Watch For
The incident highlights why patching internet-facing MagicINFO installations is important.
Security teams should pay attention to:
- Unexpected remote access software
- New administrator accounts
- Microsoft Defender being disabled
- Unusual compiler activity
- Unknown processes using high CPU resources
- Unexpected connections to cryptocurrency mining pools
Removing the miner is not enough. Teams should also determine how the attacker gained access and whether the vulnerable entry point is still exposed.
About the Author
