Huntress found an intrusion via Samsung MagicINFO CVE-2025-4632, followed by repeated AnyDesk installs, Defender tampering, and a SilentXMRMiner-based Monero miner compiled on the endpoint and tied to C3Pool. #MagicINFO #AnyDesk #C3Pool
The Not So Silent Miner: Threat Actor Compiles Cryptominer On The Endpoint
Huntress researchers investigated an intrusion that began with exploitation of a Samsung MagicINFO vulnerability, followed by repeated AnyDesk installation attempts, local account creation, and Defender tampering. The attacker then compiled a SilentXMRMiner-based Monero miner directly on the victim endpoint and connected it to C3Pool for mining. #SamsungMagicINFO #AnyDesk #SilentXMRMiner #C3Pool
www.hendryadrian.com
September 24, 2026 at 7:45 PM
Huntress found an intrusion via Samsung MagicINFO CVE-2025-4632, followed by repeated AnyDesk installs, Defender tampering, and a SilentXMRMiner-based Monero miner compiled on the endpoint and tied to C3Pool. #MagicINFO #AnyDesk #C3Pool
@huntress.com
Attackers exploited Samsung MagicINFO, installed AnyDesk, disabled Defender, and compiled a Monero miner.
-
IOCs: 194[.]87[.]89[.]30, auto[.]c3pool[.]org, oldadministrator
-
#CVE-2025-4632 #Cryptominer #ThreatIntel
Attackers exploited Samsung MagicINFO, installed AnyDesk, disabled Defender, and compiled a Monero miner.
-
IOCs: 194[.]87[.]89[.]30, auto[.]c3pool[.]org, oldadministrator
-
#CVE-2025-4632 #Cryptominer #ThreatIntel
Endpoint-Compiled Cryptominer
www.huntress.com
September 24, 2026 at 4:21 PM
@huntress.com
Attackers exploited Samsung MagicINFO, installed AnyDesk, disabled Defender, and compiled a Monero miner.
-
IOCs: 194[.]87[.]89[.]30, auto[.]c3pool[.]org, oldadministrator
-
#CVE-2025-4632 #Cryptominer #ThreatIntel
Attackers exploited Samsung MagicINFO, installed AnyDesk, disabled Defender, and compiled a Monero miner.
-
IOCs: 194[.]87[.]89[.]30, auto[.]c3pool[.]org, oldadministrator
-
#CVE-2025-4632 #Cryptominer #ThreatIntel
- 4AUZ9XNsffcPn13Yjk5yWAaZg8x5Fgu9cL9kWwDCnmACUFLuwrLg41WU31qiKfmo9ee62mVbwG9F5G82Ko8vck8nCtxdicj (Monero wallet reused across the observed deployments)
- auto[.]c3pool[.]org:443 (mining-pool endpoint used by the miner; treat as contextual because mining pools may also receive legitimate traffic)
- auto[.]c3pool[.]org:443 (mining-pool endpoint used by the miner; treat as contextual because mining pools may also receive legitimate traffic)
August 19, 2026 at 12:59 AM
- 4AUZ9XNsffcPn13Yjk5yWAaZg8x5Fgu9cL9kWwDCnmACUFLuwrLg41WU31qiKfmo9ee62mVbwG9F5G82Ko8vck8nCtxdicj (Monero wallet reused across the observed deployments)
- auto[.]c3pool[.]org:443 (mining-pool endpoint used by the miner; treat as contextual because mining pools may also receive legitimate traffic)
- auto[.]c3pool[.]org:443 (mining-pool endpoint used by the miner; treat as contextual because mining pools may also receive legitimate traffic)
#CryptoJacker #China 🇨🇳
Wallet : 4B7vD4PrcGdES1grKPBH5jbsh4SgknSzkFFRHxWMqux7bJrieQoawCiFnd36wKTPtAUXJLeQBZWKRKza7qJaQscx2kCCrZo
Pool: c3pool
Total paid :
20,767746 #XMR == 3274,1 € == 3606,19 $
Wallet : 4B7vD4PrcGdES1grKPBH5jbsh4SgknSzkFFRHxWMqux7bJrieQoawCiFnd36wKTPtAUXJLeQBZWKRKza7qJaQscx2kCCrZo
Pool: c3pool
Total paid :
20,767746 #XMR == 3274,1 € == 3606,19 $
December 22, 2023 at 7:46 PM
#CryptoJacker #China 🇨🇳
Wallet : 4B7vD4PrcGdES1grKPBH5jbsh4SgknSzkFFRHxWMqux7bJrieQoawCiFnd36wKTPtAUXJLeQBZWKRKza7qJaQscx2kCCrZo
Pool: c3pool
Total paid :
20,767746 #XMR == 3274,1 € == 3606,19 $
Wallet : 4B7vD4PrcGdES1grKPBH5jbsh4SgknSzkFFRHxWMqux7bJrieQoawCiFnd36wKTPtAUXJLeQBZWKRKza7qJaQscx2kCCrZo
Pool: c3pool
Total paid :
20,767746 #XMR == 3274,1 € == 3606,19 $