GeoVision Camera Software Exploited to Deploy XMRig Cryptominer via PowerShell and IFEO Hijacks
Between November 8 and 10, 2026, threat actors exploited publicly exposed GeoVision webcam software to deploy the XMRig cryptominer across multiple organizations. The attack chain began with the GeoStartupAgentService.exe spawning command shells running PowerShell download cradles that fetched and executed malicious scripts from a remote server. These scripts conducted reconnaissance, attempted to disable Microsoft Defender via IFEO Debugger registry hijacks and deployed a vulnerable driver (kvckiller.sys/wsftprm.sys) to tamper with antivirus protections. A custom Golang loader (update.exe) was then executed, leveraging BitTorrent DHT and PKARR for dynamic infrastructure resolution, and persisted via scheduled tasks. The campaign impacted 13 organizations across various sectors, illustrating the risks of internet-exposed surveillance systems.
Linha do tempo
-
GeoVision Camera Software Exploited to Deploy XMRig Cryptominer via PowerShell and IFEO Hijacks
ler a análise desta fonte ocultar
Between November 8 and 10, 2026, threat actors exploited publicly exposed GeoVision webcam software to deploy the XMRig cryptominer across multiple organizations. The attack chain began with the GeoStartupAgentService.exe spawning command shells running PowerShell download cradles that fetched and executed malicious scripts from a remote server. These scripts conducted reconnaissance, attempted to disable Microsoft Defender via IFEO Debugger registry hijacks and deployed a vulnerable driver (kvckiller.sys/wsftprm.sys) to tamper with antivirus protections. A custom Golang loader (update.exe) was then executed, leveraging BitTorrent DHT and PKARR for dynamic infrastructure resolution, and persisted via scheduled tasks. The campaign impacted 13 organizations across various sectors, illustrating the risks of internet-exposed surveillance systems.