[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f-zVKSujp5HhPT_AnIQhPNOH5RvxUAjvxsEJyHw1ssVA":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":22,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":49,"controls":50},"cbaf87b9-1b97-40c8-b3d2-f77bd0b4eb54","on-machine-cryptominer-compilation-exposes-attackers-who-exploited-unpatched-cve","2580ca9a-c961-4d2d-8ebf-b9705c3774e4","On-Machine Cryptominer Compilation Exposes Attackers Who Exploited Unpatched CVE","Threat actors exploited CVE-2025-4632 to gain a foothold on victim machines, then took the unusual step of compiling a cryptocurrency miner directly on the compromised host rather than deploying a pre-built binary — likely to evade signature-based detection. Ironically, the intensive CPU and disk activity generated during the compilation process created enough noise to alert defenders, inadvertently revealing the intrusion. This incident highlights that delayed patching of known vulnerabilities remains one of the most exploited weaknesses in enterprise environments. It also underscores that even 'living-off-the-land' or evasion-focused techniques can be detected when robust behavioral monitoring is in place, demonstrating the critical value of anomaly-based alerting over purely signature-based defenses.","**Immediate actions:**\n- Apply the vendor-supplied patch for CVE-2025-4632 immediately across all affected systems and verify patch deployment with a follow-up scan.\n- Run an emergency threat hunt for indicators of compromise such as unexpected compiler toolchain usage (e.g., gcc, make, cl.exe) on non-development endpoints.\n- Isolate any systems showing anomalous CPU spikes or build-tool activity until they can be forensically investigated.\n\n**Long-term improvements:**\n- Maintain a continuously updated, prioritized asset inventory so critical systems can be patched within defined SLA windows (e.g., 24–72 hours for critical CVEs).\n- Enforce application allowlisting on servers and endpoints to block unauthorized execution of compilers and build tools.\n- Implement network segmentation to limit lateral movement and restrict outbound connections from servers to only known-good destinations.\n\n**Detection measures:**\n- Deploy behavioral monitoring rules that alert on compiler or build-tool execution outside of approved developer workstations and CI\u002FCD pipelines.\n- Establish baselines for CPU, disk I\u002FO, and network utilization per host class, and trigger alerts on significant deviations indicative of cryptomining or compilation activity.\n- Aggregate and centrally analyze endpoint telemetry (process creation, file writes, network connections) in a SIEM to correlate multi-stage attack chains in near real-time.",[12,13,14,15,16,17,18,19,20,21],"CIS Control 7: Continuous Vulnerability Management","CIS Control 10: Malware Defenses (Application Allowlisting)","CIS Control 13: Network Monitoring and Defense","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management","NIST SI-2: Flaw Remediation","NIST SI-4: System Monitoring","NIST CM-7: Least Functionality (restrict unauthorized software)","MITRE ATT&CK T1496: Resource Hijacking (Cryptomining)","MITRE ATT&CK T1204 \u002F T1059: Execution via compiled code on host","ITIL Problem Management: Root Cause Analysis for recurring vulnerability exploitation",{},"published","2026-09-25T14:21:02.637086+00:00","2026-09-25T14:21:02.041+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fwww.itsecurityguru.org\u002F2026\u002F09\u002F25\u002Fattackers-build-silent-cryptominer-on-victims-machine-and-give-themselves-away\u002F?utm_source=rss&utm_medium=rss&utm_campaign=attackers-build-silent-cryptominer-on-victims-machine-and-give-themselves-away","attackers-build-silent-cryptominer-on-victim-s-machine-and-give-themselves-away-6c7610","Attackers build “silent” cryptominer on victim’s machine and give themselves away",[31,37,43],{"id":32,"name":33,"slug":34,"description":35,"color":36},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":38,"name":39,"slug":40,"description":41,"color":42},"1732a005-556e-411c-a9db-5edec3058571","Logging & Monitoring","logging-monitoring","Missing logs, no alerting, blind spots","#a855f7",{"id":44,"name":45,"slug":46,"description":47,"color":48},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[],[51,54,57],{"slug":34,"name":52,"problem":53},"Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":46,"name":55,"problem":56},"Automated patch management","Known holes get closed in days, not months.",{"slug":58,"name":59,"problem":60},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped."]