Sophisticated? Stealthy?
Not always.
www.huntress.com/blog/threat-...
huntress.com
The Not So Silent Miner: Threat Actor Compiles Cryptominer on the Endpoint | Huntress
Threat actors exploited Samsung MagicINFO to install AnyDesk, disable Defender, and compile a Monero miner directly on a victim endpoint. Learn the detection signals.