Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
5 IOCs
Samsung MagicINFO Flaw Used to Deploy AnyDesk and Compile Stealthy Cryptominer Payloads
Excerpt
Attackers exploited a known Samsung MagicINFO flaw to install remote-access software and build a Monero cryptominer directly on a victim’s Windows endpoint. The unusual build process created a burst of activity that made the attack easier to spot in endpoint telemetry. Huntress detected the activity in early September 2026 on a system running Samsung MagicINFO Premium, software used to manage digital signage. Researchers linked the initial access to CVE-2025-4632, a path…
Read the original report →Diamond Model
Adversary
Infrastructure(1)
Capability
Victim
Indicators of Compromise
Open the mindmap →5 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| CVE | CVE-2025-4632 | Medium | Score 51/100 | First seen |
| MD5 | ea4ad408a1e54fad9099541f3ee81fab | Medium | Score 53/100 | First seen |
| MD5 | 30d4db79a09f43deaee9268fd138b798 | Medium | Score 53/100 | First seen |
| MD5 | 3eb6f92aedf74f109c7b4b0897ec39a8 | High | Score 81/100 | First seen |
| IP | 194.87.89.30 | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…