Loading story…
A threat actor compromised a managed endpoint by exploiting CVE-2025-4632, an arbitrary-file-write vulnerability in Samsung MagicINFO Premium that executes with SYSTEM privileges. The actor attempted repeatedly to download and install AnyDesk from 194.87.89[.]30, created a local account named oldadministrator, and disabled Microsoft Defender to establish and retain access.
The intruder then used Silent XMR Miner Builder.exe to compile a Monero cryptominer directly on the compromised system, generating .NET utility and C-compiler activity that can provide defenders with detectable telemetry. The completed miner connected to the C3Pool mining service and consumed the endpoint’s CPU—and potentially GPU—for Monero mining, demonstrating continued abuse of a publicly exposed vulnerability despite an available patch.
See which actors are running it and whether you're in range.
5 events from the most recent confirmed update back to the earliest known activity.
The actor ran Silent XMR Miner Builder.exe from the new user's Documents folder, spawning .NET and C compilation tools to build a cryptominer directly on the compromised host. The resulting executable connected to auto.c3pool.org:19999 and used the RandomX rx/0 algorithm to mine Monero using the host's CPU and potentially GPU.
The threat actor used SystemSettingsAdminFlows.exe to disable Microsoft Defender after Defender had detected and remediated earlier AnyDesk download attempts.
After the compromise, the actor repeatedly attempted to download AnyDesk from 194.87.89[.]30:8899, eventually installing it and configuring a password. The actor also created a local account named oldadministrator, using the same password for that account and AnyDesk.
In early September 2026, a threat actor compromised a managed endpoint by exploiting CVE-2025-4632 in Samsung MagicINFO Premium. Malicious commands executed through tomcat9.exe linked the activity to the MagicINFO access vector.
Samsung fixed CVE-2025-4632 in MagicINFO Premium after determining that the prior fix for CVE-2024-7399 was incomplete. The vulnerability could allow arbitrary file writes with SYSTEM authority.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers exploited multiple publicly disclosed **pre-authentication vulnerabilities** in internet-exposed enterprise products to install **Monero-mining malware** on both Windows and Linux systems. Observed targets included **Apache HTTP Server**, **Atlassian Confluence**, **F5 BIG-IP**, **VMware vCenter**, and **Oracle WebLogic Server**, with exploitation attempts seen in the wild through honeypots. The operation abused trusted cloud platforms **GitHub** and **Netlify** to host delivery scripts and miner payloads, helping the malware blend into normal HTTPS traffic before the hosted content was removed. On Windows, the malware used batch scripts to profile infected hosts, download **XMRig** and supporting components, establish persistence, and run the miner as a background service. On Linux, shell scripts killed high-CPU processes, removed competing miners, fetched multiple binaries and configuration files, and launched mining with `nohup`. The campaign highlighted how public proof-of-concept exploits, unpatched exposed servers, and the use of legitimate hosting services combined to sustain large-scale cryptojacking activity.
Aug 14, 2026
Attackers built a cryptojacking botnet by exploiting **`CVE-2017-7269`**, a WebDAV buffer overflow in unpatched **Microsoft IIS 6.0** servers running on **Windows Server 2003**. The campaign, active since at least May 2017, used internet-wide scanning from **Amazon Web Services-hosted IP addresses** to find vulnerable systems and then delivered shellcode that downloaded and executed a minimally modified version of the open-source **`xmrig`** miner. The compromised servers were used to mine **Monero**, with the operation reportedly growing to several hundred machines and generating more than **420 XMR**, worth over **$63,000** at the time. ESET said it detected the miner as **`Win32/CoinMiner.AMW`** and the exploit traffic as **`webDAV/ExplodingCan`**, and urged administrators to apply Microsoft patch **`KB3197835`** and other critical updates to protect exposed legacy servers.
Aug 14, 2026
Researchers reported two malware campaigns that install cryptocurrency miners through trojanized downloads delivered from pirate streaming sites and fake software portals. In one operation, users visiting illicit movie and TV sites were shown a bogus video-plugin update that delivered a ZIP archive containing a legitimate executable and a malicious DLL; the DLL sideloaded a multi-stage miner framework with persistence, defense evasion, a watchdog, a **RAT** component, and CPU/GPU mining modules. The malware, a modified fork of SilentCryptoMiner, used DNS tunneling for execution gating, installed a service named `GoogleUpdateTaskMachineQC`, weakened Windows defenses, injected into `conhost.exe` and `explorer.exe`, and communicated through rotating domains and infrastructure tied to `107[.]172[.]212[.]235`. Microsoft described a related cryptojacking-focused campaign aimed at owners of high-performance PCs, using fake downloads of popular utilities and hardware-monitoring tools that were promoted through SEO poisoning and, more recently, surfaced in AI assistant recommendations. Those ZIP archives also paired a legitimate executable with a malicious DLL for sideloading, then installed **ScreenConnect** for persistent remote access, set registry autoruns and scheduled tasks, added Microsoft Defender exclusions, checked for analysis tools, and used process hollowing to launch payloads inside trusted Windows processes. After profiling infected systems, the attackers fetched GPU miners including **gminer**, **lolMiner**, and **SRBMiner-MULTI**; researchers warned the access could support not only cryptomining but also data theft, lateral movement, and eventual ransomware deployment.
Jun 29, 2026