Threats Tagged 'c3pool'

A threat actor exploited a path traversal vulnerability in Samsung MagicINFO 9 Server (CVE-2025-4632) to gain access to endpoints. They deployed a rogue AnyDesk instance, created a local administrator account, and disabled Microsoft Defender protections. Instead of using a pre-compiled cryptominer, the actor compiled a Monero cryptominer directly on the compromised endpoint using multiple compilers and utilities. The miner connected to the C3Pool mining service and ran under explorer.exe with suspicious arguments. This on-endpoint compilation generated significant EDR telemetry, making the activity more detectable despite attempts at stealth.