Skip to main content
CVE-2024-7399MalwarePublished 09/24/2026Updated 10/24/2026

The Not So Silent Miner: Threat Actor Compiles Cryptominer on the Endpoint

Affects Samsung MagicINFO 9 ServerSource AlienVault OTX General

0

Mentioned vulnerabilities

Exploited in the wild · KEV due 8 May 2026 · public exploit available (Metasploit) · 91% EPSS : block it and hunt for it in your logs now.

Data as of 10/24/2026, 17:08:22 UTC

Exploitation

Actively exploited

No CVSS score from NVD or the CNA

Evidence

In CISA KEV since 04/24/2026

KEV deadline
05/08/2026 US federal agencies must patch by this date; a sensible deadline for everyone else.
EPSS
91.9% chance of exploitation in 30 days – higher than 99% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Public exploits
1 Metasploit module, a Nuclei detection templatePublic attack or detection tooling exists; see Public exploits below.

What to do

CISA required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Public exploits and detection

Public tooling indexed from Metasploit Framework, Exploit-DB and ProjectDiscovery nuclei-templates. Its existence raises the odds of exploitation; it does not confirm attacks.

Description

A threat actor exploited a path traversal vulnerability in Samsung MagicINFO 9 Server (CVE-2025-4632) to gain access to endpoints. They deployed a rogue AnyDesk instance, created a local administrator account, and disabled Microsoft Defender protections. Instead of using a pre-compiled cryptominer, the actor compiled a Monero cryptominer directly on the compromised endpoint using multiple compilers and utilities. The miner connected to the C3Pool mining service and ran under explorer.exe with suspicious arguments. This on-endpoint compilation generated significant EDR telemetry, making the activity more detectable despite attempts at stealth.

Impact

Successful exploitation allows attackers to gain persistent administrative access on affected endpoints, disable security protections, and run unauthorized cryptomining operations. The on-endpoint compilation of the miner increases detection telemetry, but the attacker maintains control and resource abuse through Monero mining. This activity can degrade system performance and increase operational costs due to resource consumption.

Defensive guidance

Apply mitigations per vendor instructions, including restricting access to MagicINFO servers and monitoring for suspicious AnyDesk deployments and new local administrator accounts. Ensure Microsoft Defender or equivalent endpoint protections are enabled and investigate unusual compilation activity and command-line arguments related to explorer.exe. Follow applicable cybersecurity guidance such as CISA KEV recommendations for this vulnerability.

Weaknesses

MITRE ATT&CK techniques

Indicators of compromise

URLs 1

  • http://194.87.89.30:8899/anydesk.exe

Hashes 1

  • 0d202e16408770e8b6cceb14e1e3e72946b154bf881d27fe33d0060315b30dd1

CVEs 3

  • CVE-2024-7399
  • CVE-2025-4632
  • CVE-2025-47812

Community reviews

Loading reviews…