Post-exploitation activity triggered by Samsung MagicINFO 9 server vulnerability

Huntress discovered an exploit campaign targeting Samsung MagicINFO 9 servers, involving version 21.1050.0. Despite 75 devices having the system installed, only three attacks were observed. The attackers tried to install the service but failed, and downloaded renamed files to confuse. It is recommended to put the server behind a firewall to prevent further attacks.

Since the beginning of May 2025, the cybersecurity company Arctic Wolf has warned against active attacks on Samsung MagicINFO 9. The affected software is used worldwide for central management of digital display systems – for example in retail, public communications and companies. The vulnerability CVE-2024-7399 allows attackers to write arbitrary files on the server and thus potentially execute malicious code. From laboratory to reality: PoC Exp…