Threat actors are abusing internet-exposed GeoVision surveillance software to break into corporate networks, disable Microsoft Defender, and quietly install cryptomining malware, according to new research from Huntress.
The Huntress Security Operations Centre (SOC) began seeing the activity on 8 November, with most attacks landing between 8 and 10 November and activity continuing over the past week. So far, 13 organisations across a range of industries have been affected. GeoVision is a Taiwanese surveillance and access-control vendor.
Every incident traced back to the same source: GeoStartupAgentService.exe, a GeoVision service that on many machines was running with full SYSTEM privileges. Searches of the victims’ external IP addresses on Shodan showed GeoVision devices or management interfaces sitting openly on the internet.
Blinding the defences first
Once the attackers had a foothold, the GeoVision service spawned a command shell that pulled down a chain of PowerShell scripts from an attacker-controlled server. Before installing their payload, the attackers worked to disarm the victim’s security tools.
The scripts checked whether Microsoft Defender was running and downloaded a vulnerable kernel driver, wsftprm.sys (disguised as kvckiller.sys), which has previously been abused in Bring Your Own Vulnerable Driver (BYOVD) attacks to tamper with antivirus. The attackers also used Image File Execution Options (IFEO), a legitimate Windows debugging feature, to hijack the Defender antivirus engine and Windows Security components. This redirected them to launch systray.exe instead, likely to stop the protections from starting at all.
Persistent, and hard to take down
With defences weakened, a final script dropped a custom loader written in Go, which reached out to infrastructure linked to the domain cctv-update[.]top. The domain was registered on 7 November, the day before the attacks began.
The loader stands out for its resilience. It includes a BitTorrent Mainline DHT client and a PKARR resolver, which let it find the attacker’s current servers using a public key on the BitTorrent peer-to-peer network. That means the operator can move infrastructure without registering new domains, and taking down a single server won’t cut off access.
On some machines, the loader created scheduled tasks named PackageUpdater and PackageUpdater_Startup to relaunch itself every 15 minutes and at boot. It then installed the XMRig cryptominer, disguised as ApplyUpdate.exe, to hijack the victims’ computing power.
Cameras are part of the attack surface
Huntress said the campaign is the latest in a series of incidents it has seen where attackers target camera systems. It urged organisations to treat camera management software as part of the enterprise attack surface, not as a separate building-security concern.
Huntress recommends that organisations running GeoVision software:
- Remove unnecessary internet exposure of GeoVision devices and management interfaces, putting them behind a VPN or restricting access to trusted IP addresses.
- Investigate any unexpected command shells or PowerShell launched by GeoStartupAgentService.exe.
- Watch for outbound UDP DHT traffic (port 6881 or similar) from the GeoVision process WebCamServer.exe, DNS queries to public resolvers made by processes other than the system DNS client, and schtasks /Create commands launched by update.exe.
- Isolate any affected hosts and preserve evidence before removing files or changing configurations.
The full advisory, including indicators of compromise and MITRE ATT&CK mappings, is available on the Huntress blog: https://www.huntress.com/blog/geovision-camera-software-xmrig-cryptominer
