SilentXMRMiner On-Endpoint Compilation via Samsung MagicINFO CVE-2025-4632: OTX Pulse Analysis — Rogue AnyDesk, 'oldadministrator' Persistence & Monero Mining Detection Pack

AlienVault OTX pulse data (TLP:WHITE, modified 2026-10-24) documents an active intrusion campaign in which an unidentified threat actor exploits CVE-2025-4632, a vulnerability in Samsung MagicINFO digital signage server software, to obtain initial access to victim endpoints. The pulse — derived from a Huntress investigation — reveals a campaign that is notable not for exotic tooling, but for operational pragmatism: the actor failed twice before successfully deploying a rogue AnyDesk remote access instance on the third attempt, cycling through multiple download methods including certutil.exe and PowerShell download cradles.

Once remote access was established, the actor executed a classic post-exploitation playbook: created a local administrator account named oldadministrator (a masquerade attempt designed to blend into legacy environments), disabled Microsoft Defender protections, and then deployed SilentXMRMiner — a Monero (XMR) cryptomining payload. The operationally distinctive element of this campaign is that rather than dropping a pre-compiled miner binary (which would trigger static AV signatures), the actor compiles the cryptominer directly on the victim endpoint, defeating hash-based detection and many signature-driven controls.

The mining operation communicates with c3pool, a known Monero mining pool frequently abused in criminal cryptojacking campaigns. Infrastructure observed includes a bare-IP staging server at 194.87.89.30:8899 hosting the AnyDesk installer. The convergence of three CVEs in the indicator set — CVE-2024-7399, CVE-2025-4632, and CVE-2025-47812 — suggests the actor is opportunistically scanning for exposed MagicINFO and adjacent vulnerable services, prioritizing unpatched internet-facing management consoles as low-cost entry points. The objective is straightforward monetization: hijacked CPU/GPU cycles converted to Monero, with persistence maintained via the rogue RMM tool and the backdoor admin account should the miner be discovered and removed.

Threat Actor / Malware Profile

SilentXMRMiner is a Monero-focused cryptomining malware family distributed through cracked software, malicious installers, and — as this campaign demonstrates — hands-on-keyboard post-exploitation deployment. Key characteristics observed in this campaign:

• Distribution method: Initial access via exploitation of Samsung MagicINFO (CVE-2025-4632), followed by payload staging over HTTP from attacker-controlled bare-IP infrastructure (http://194.87.89.30:8899/anydesk.exe). Download execution via living-off-the-land binaries: certutil.exe -urlcache and PowerShell Invoke-WebRequest/DownloadString patterns.
• Payload behavior: Rather than delivering a static miner binary, the actor transfers miner source or a builder and compiles SilentXMRMiner on the endpoint itself. Expect to observe unexpected invocations of compilers or build toolchains (csc.exe, MSBuild.exe, gcc, make) on systems that have no legitimate development function — particularly digital signage and kiosk-class machines. The compiled miner then connects to the c3pool Monero mining pool, consuming CPU resources and degrading host performance.
• C2 / communication: Mining traffic to c3pool infrastructure over standard mining protocol ports (stratum over TCP, commonly 3333/5555/7777 or TLS-wrapped 443). The rogue AnyDesk instance provides interactive C2, generating outbound connections to AnyDesk relay infrastructure (*.net.anydesk.com) from a host with no sanctioned RMM deployment.
• Persistence mechanism: Dual-layer persistence: (1) a newly created local administrator account named oldadministrator, and (2) the rogue AnyDesk service, which survives reboots and reinstalls itself as a system service. The miner itself may add scheduled tasks or registry Run keys post-compilation.
• Anti-analysis / defense evasion: On-endpoint compilation defeats hash reputation and static signatures. The actor explicitly disables Microsoft Defender (via Set-MpPreference, registry tampering, or Add-MpPreference -ExclusionPath) before payload staging. The oldadministrator account name is deliberately chosen to appear as a legacy service account, evading casual review of local admin group membership.

Mapped MITRE ATT&CK techniques: T1190 (Exploit Public-Facing Application), T1105 (Ingress Tool Transfer), T1218.011 (System Binary Proxy Execution: Certutil — wait, signed binary proxy execution), T1136.001 (Create Account: Local Account), T1562.001 (Impair Defenses: Disable or Modify Tools), T1496 (Resource Hijacking), T1027 (Obfuscated Files or Information — via on-host compilation), T1219 (Remote Access Software).

IOC Analysis

The pulse carries five indicators across three types:

• CVEs (3): CVE-2024-7399, CVE-2025-4632, CVE-2025-47812. These are exploitation vector indicators, not blockable artifacts. Operationalize them through your vulnerability management platform: scan for Samsung MagicINFO deployments (frequently forgotten appliances in retail, hospitality, and corporate lobbies), confirm patch status, and isolate any instance reachable from the internet. CVE indicators should drive exposure queries in your EDR/ASM tooling, not blocklists.
• FileHash-SHA256 (1): 0d202e16408770e8b6cceb14e1e3e72946b154bf881d27fe33d0060315b30dd1 — the staged AnyDesk/malware artifact. Push to EDR blocklists and query historical execution telemetry. Caution: because the miner is compiled on-endpoint, the final miner binary hash will be unique per victim — hash detection alone is insufficient; behavioral detection is mandatory.
• URL (1): http://194.87.89.30:8899/anydesk.exe — bare-IP staging server on a non-standard port. Block the IP and URL at the proxy/firewall. Bare IPs serving executable content on high ports are high-confidence malicious with near-zero false-positive risk.

SOC operationalization: ingest the hash into your EDR's custom indicator list, add the IP/URL to DNS sinkhole and egress filtering, and pivot on the AnyDesk binary name and 8899 port in proxy logs. Decode and detonate the hash in a sandbox (ANY.RUN, Joe Sandbox, VirusTotal) to extract the compiled-miner behavior profile and c3pool wallet identifiers for broader hunting.

Detection Engineering

---
title: Rogue AnyDesk Deployment via LOLBin Download
description: Detects certutil or PowerShell downloading AnyDesk or executables from bare-IP infrastructure, matching the SilentXMRMiner campaign staging pattern (CVE-2025-4632 exploitation chain).
logsource:
  category: process_creation
  product: windows
detection:
  selection_certutil:
    Image|endswith: '\certutil.exe'
    CommandLine|contains:
      - '-urlcache'
      - 'anydesk'
      - '8899'
  selection_ps:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - 'DownloadFile'
      - 'DownloadString'
      - 'Invoke-WebRequest'
      - 'Start-BitsTransfer'
  selection_target:
    CommandLine|contains:
      - 'anydesk.exe'
      - '194.87.89.30'
      - ':8899'
  condition: (selection_certutil or selection_ps) and selection_target
falsepositives:
  - Legitimate enterprise AnyDesk deployment via scripted software distribution
level: high
tags:
  - attack.command_and_control
  - attack.t1105
  - attack.t1219
  - attack.t1218
status: experimental
author: Security Arsenal Threat Intelligence
date: 2026/10/24
---
title: Suspicious Local Admin Account Creation - oldadministrator
description: Detects creation of the 'oldadministrator' local account observed as a persistence mechanism in the SilentXMRMiner / MagicINFO exploitation campaign.
logsource:
  category: process_creation
  product: windows
detection:
  selection_net:
    Image|endswith:
      - '\net.exe'
      - '\net1.exe'
    CommandLine|contains:
      - 'oldadministrator'
  selection_ps:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - 'oldadministrator'
  condition: selection_net or selection_ps
falsepositives:
  - None expected; this account name is not part of standard Windows provisioning
level: critical
tags:
  - attack.persistence
  - attack.t1136.001
status: experimental
author: Security Arsenal Threat Intelligence
date: 2026/10/24
---
title: Defender Tampering Followed by On-Endpoint Compilation
description: Detects Microsoft Defender being disabled or exclusion paths added, followed by or alongside compilation toolchains (csc.exe, MSBuild.exe) executing from non-developer contexts - hallmark of the SilentXMRMiner on-endpoint compilation technique.
logsource:
  category: process_creation
  product: windows
detection:
  selection_defender:
    CommandLine|contains:
      - 'Set-MpPreference'
      - 'Add-MpPreference'
      - 'DisableRealtimeMonitoring'
      - 'ExclusionPath'
      - 'DisableBehaviorMonitoring'
  selection_compiler:
    Image|endswith:
      - '\csc.exe'
      - '\MSBuild.exe'
      - '\vbc.exe'
      - '\gcc.exe'
      - '\make.exe'
  selection_compiler_parent:
    ParentImage|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\anydesk.exe'
      - '\explorer.exe'
  condition: selection_defender or (selection_compiler and selection_compiler_parent)
falsepositives:
  - Developer workstations legitimately running build toolchains (filter by host role)
  - IT administrators tuning Defender exclusions during software deployment
level: high
tags:
  - attack.defense_evasion
  - attack.t1562.001
  - attack.t1027
  - attack.impact
  - attack.t1496
status: experimental
author: Security Arsenal Threat Intelligence
date: 2026/10/24

// SilentXMRMiner / MagicINFO Campaign Hunt - Microsoft Sentinel
// Hunts IOCs, rogue AnyDesk, suspicious account creation, and miner compilation behavior
let stagingIP = "194.87.89.30";
let knownHash = "0d202e16408770e8b6cceb14e1e3e72946b154bf881d27fe33d0060315b30dd1";
let lookback = 14d;
union isfuzzy=true
  // Network connections to staging infrastructure or mining pools
  (DeviceNetworkEvents
  | where TimeGenerated > ago(lookback)
  | where RemoteIP == stagingIP or RemoteUrl has "c3pool"
     or (RemotePort in (3333, 5555, 7777, 8899) and RemoteIP !startswith "10." and RemoteIP !startswith "192.168.")
  | project TimeGenerated, DeviceName, RemoteIP, RemotePort, RemoteUrl, InitiatingProcessFileName, InitiatingProcessCommandLine),
  // Process artifacts: AnyDesk download, account creation, Defender tampering, on-host compilation
  (DeviceProcessEvents
  | where TimeGenerated > ago(lookback)
  | where ProcessCommandLine has_any ("oldadministrator", "anydesk.exe", "-urlcache", "ExclusionPath", "DisableRealtimeMonitoring", "c3pool")
     or FileName in~ ("csc.exe", "MSBuild.exe", "vbc.exe") and InitiatingProcessFileName in~ ("powershell.exe", "cmd.exe", "AnyDesk.exe")
     or SHA256 == knownHash
  | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, SHA256, AccountName),
  // Local account creation events
  (SecurityEvent
  | where TimeGenerated > ago(lookback)
  | where EventID == 4720 and TargetUserName =~ "oldadministrator"
  | project TimeGenerated, Computer, TargetUserName, SubjectUserName, SubjectLogonId)
| order by TimeGenerated desc

# SilentXMRMiner Campaign IOC Hunt - Run on suspected endpoints or via GPO/Intune
# Checks persistence, Defender tampering, rogue AnyDesk, and mining artifacts
$report = @()

# 1. Check for rogue 'oldadministrator' local account
$rogueAcct = Get-LocalUser -Name "oldadministrator" -ErrorAction SilentlyContinue
if ($rogueAcct) { $report += "[ALERT] Rogue local account found: oldadministrator (Enabled: $($rogueAcct.Enabled))" }
$admins = Get-LocalGroupMember -Group "Administrators" -ErrorAction SilentlyContinue | Where-Object { $_.Name -match "oldadministrator" }
if ($admins) { $report += "[ALERT] oldadministrator is a member of local Administrators" }

# 2. Defender tampering - real-time monitoring state and exclusions
$mp = Get-MpPreference -ErrorAction SilentlyContinue
if ($mp.DisableRealtimeMonitoring) { $report += "[ALERT] Defender real-time monitoring is DISABLED" }
if ($mp.ExclusionPath) { $report += "[WARN] Defender exclusion paths set: $($mp.ExclusionPath -join '; ')" }

# 3. Rogue AnyDesk service / process / installation
$anydeskSvc = Get-Service -Name "AnyDesk*" -ErrorAction SilentlyContinue
if ($anydeskSvc) { $report += "[WARN] AnyDesk service present: $($anydeskSvc.Name) - Status: $($anydeskSvc.Status) (verify against approved software inventory)" }
$anydeskPaths = @("$env:ProgramFiles\AnyDesk", "${env:ProgramFiles(x86)}\AnyDesk", "$env:APPDATA\AnyDesk", "C:\anydesk.exe", "$env:TEMP\anydesk.exe")
foreach ($p in $anydeskPaths) { if (Test-Path $p) { $report += "[WARN] AnyDesk artifact found: $p" } }

# 4. Network connections to staging IP and mining pool ports
$conns = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
  Where-Object { $_.RemoteAddress -eq "194.87.89.30" -or $_.RemotePort -in @(3333, 5555, 7777, 8899) -and $_.RemoteAddress -notmatch "^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.)" }
foreach ($c in $conns) {
  $proc = Get-Process -Id $c.OwningProcess -ErrorAction SilentlyContinue
  $report += "[ALERT] Suspicious connection: $($c.RemoteAddress):$($c.RemotePort) by $($proc.ProcessName) (PID $($c.OwningProcess))"
}

# 5. Recent compiled artifacts in user-writable/temp locations (on-endpoint compilation residue)
$compileResidue = Get-ChildItem -Path $env:TEMP, "C:\Users\Public", "$env:APPDATA" -Recurse -Include *.exe -ErrorAction SilentlyContinue |
  Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-14) -and $_.Length -gt 500KB }
foreach ($f in $compileResidue) { $report += "[INFO] Recent executable in writable path: $($f.FullName) ($($f.LastWriteTime))" }

# 6. Scheduled tasks referencing miner/AnyDesk persistence
$tasks = Get-ScheduledTask -ErrorAction SilentlyContinue | Where-Object { $_.TaskName -match "anydesk|miner|xmr|update" -and $_.TaskPath -notmatch "Microsoft" }
foreach ($t in $tasks) { $report += "[WARN] Suspicious scheduled task: $($t.TaskPath)$($t.TaskName)" }

if ($report.Count -eq 0) { Write-Output "[CLEAN] No SilentXMRMiner campaign artifacts detected on $env:COMPUTERNAME" }
else { $report | ForEach-Object { Write-Output $_ } }

Response Priorities

Immediate (0-4 hours):

• Block 194.87.89.30 and the staging URL at egress firewall, proxy, and DNS layers; push SHA256 0d202e16408770e8b6cceb14e1e3e72946b154bf881d27fe33d0060315b30dd1 to EDR blocklists.
• Hunt enterprise-wide for the oldadministrator local account (Event ID 4720/4732) and disable it where found; treat any host with this account as compromised and isolate it.
• Query for any AnyDesk installation not present in the approved software inventory — kill processes, remove services, and collect the binary for analysis.
• Identify all Samsung MagicINFO instances in the environment, including forgotten signage appliances, and take exposed instances offline pending patching.

24 hours:

• Although SilentXMRMiner is a miner rather than a stealer, the actor had interactive AnyDesk access — assume credential exposure on every touched host. Force password resets for all local accounts and any domain accounts with interactive logons on affected machines; review for DCSync or LSASS access indicators.
• Review Defender tampering telemetry (Event ID 5007, Set-MpPreference execution) to establish the full timeline of each intrusion; the actor's three-attempt deployment pattern means earlier failed attempts likely left forensic traces.
• Inspect mining-pool egress (stratum ports, c3pool domains) for additional victims that never triggered endpoint alerts.

1 week:

• Patch CVE-2025-4632, CVE-2024-7399, and CVE-2025-47812 across all MagicINFO deployments; place signage/management infrastructure behind a management VLAN with no direct internet exposure.
• Deploy application control (WDAC/AppLocker) rules blocking unauthorized RMM tools — AnyDesk, and its common alternates — on all non-IT endpoints.
• Alert on compiler toolchain execution (csc.exe, MSBuild.exe) from non-developer host roles as a standing analytic; on-endpoint compilation is a repeatable evasion pattern that will outlive this campaign.
• Enable tamper protection and restrict Defender modification rights to prevent the DisableRealtimeMonitoring step from succeeding silently in future intrusions.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub