OTX Threat: The Not So Silent Miner: Threat Actor Compiles Cryptominer on the Endpoint

A threat actor exploited a Samsung MagicINFO vulnerability (CVE-2025-4632) to gain initial access to victim endpoints. After three attempts, they successfully deployed a rogue AnyDesk instance using various download methods including certutil and PowerShell. The actor created a new local administrator account named 'oldadministrator' and disabled Microsoft Defender protections. Uniquely, instead o CVEs: CVE-2024-7399, CVE-2025-4632, CVE-2025-47812