[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fmKzGB8SKxo2nYiUDQ4WafSZLHTX5ZU-m9ijjUPARTdc":3},{"article":4,"iocs":40,"watch_terms":45,"solutions":46,"lesson":138},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":27},"2580ca9a-c961-4d2d-8ebf-b9705c3774e4","Attackers build “silent” cryptominer on victim’s machine and give themselves away","attackers-build-silent-cryptominer-on-victim-s-machine-and-give-themselves-away-6c7610","Security researchers at Huntress have uncovered an unusual attack in which a threat actor compiled a cryptocurrency miner directly on a victim’s computer, rather than simply dropping a ready-made one, and in doing so generated so much activity that the intrusion stood out. The incident began in early September 2026 with the exploitation of CVE-2025-4632, […] The post Attackers build “silent” cryptominer on victim’s machine and give themselves away appeared first on IT Security Guru.","Huntress researchers discovered an unusual attack where threat actors compiled a cryptocurrency miner directly on victim machines. This process generated significant activity, inadvertently revealing the intrusion. The attack chain began in early September 2026 with the exploitation of CVE-2025-4632.","Attackers compiled a cryptominer on victim machines, leading to noticeable activity.","https:\u002F\u002Fwww.itsecurityguru.org\u002F2026\u002F09\u002F25\u002Fattackers-build-silent-cryptominer-on-victims-machine-and-give-themselves-away\u002F?utm_source=rss&utm_medium=rss&utm_campaign=attackers-build-silent-cryptominer-on-victims-machine-and-give-themselves-away",null,"2026-09-25T12:20:43+00:00","2026-09-25T14:00:13.849015+00:00",7,[17,20],{"name":18,"type":19},"cryptocurrency miner","product",{"name":21,"type":22},"Huntress","vendor","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":23,"icon":12,"name":25,"slug":26},"Malware","malware",[28,33,35],{"category":29},{"id":30,"icon":12,"name":31,"slug":32},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":34},{"id":23,"icon":12,"name":25,"slug":26},{"category":36},{"id":37,"icon":12,"name":38,"slug":39},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[41],{"type":42,"value":43,"context":44},"cve","CVE-2025-4632","Vulnerability exploited to initiate the attack",[21,18],{"controls":47,"vendors":132},[48,77,106],{"slug":49,"name":50,"problem":51,"products":52},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[53,61,69],{"vendor_slug":54,"vendor_name":55,"vendor_logo":56,"product_slug":57,"product_name":58,"url":59,"description":60},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"slug":78,"name":79,"problem":80,"products":81},"patch-management","Automated patch management","Known holes get closed in days, not months.",[82,90,98],{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":107,"name":108,"problem":109,"products":110},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[111,119,127],{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":128,"product_name":129,"url":130,"description":131},"defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",[133],{"slug":134,"name":21,"logo_path":135,"roles":136},"huntress","\u002Fvendor-logos\u002Fhuntress.png",[137],"reported_by",{"slug":139,"title":140,"body":141,"framework_refs":142,"framework_notes":153},"on-machine-cryptominer-compilation-exposes-attackers-who-exploited-unpatched-cve","On-Machine Cryptominer Compilation Exposes Attackers Who Exploited Unpatched CVE","Threat actors exploited CVE-2025-4632 to gain a foothold on victim machines, then took the unusual step of compiling a cryptocurrency miner directly on the compromised host rather than deploying a pre-built binary — likely to evade signature-based detection. Ironically, the intensive CPU and disk activity generated during the compilation process created enough noise to alert defenders, inadvertently revealing the intrusion. This incident highlights that delayed patching of known vulnerabilities remains one of the most exploited weaknesses in enterprise environments. It also underscores that even 'living-off-the-land' or evasion-focused techniques can be detected when robust behavioral monitoring is in place, demonstrating the critical value of anomaly-based alerting over purely signature-based defenses.",[143,144,145,146,147,148,149,150,151,152],"CIS Control 7: Continuous Vulnerability Management","CIS Control 10: Malware Defenses (Application Allowlisting)","CIS Control 13: Network Monitoring and Defense","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management","NIST SI-2: Flaw Remediation","NIST SI-4: System Monitoring","NIST CM-7: Least Functionality (restrict unauthorized software)","MITRE ATT&CK T1496: Resource Hijacking (Cryptomining)","MITRE ATT&CK T1204 \u002F T1059: Execution via compiled code on host","ITIL Problem Management: Root Cause Analysis for recurring vulnerability exploitation",{}]