GeoVision camera software exploited to disable Defender and deploy XMRig miner via Go loader in 13 organizations
Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 14/11/2026 00:01; os links antigos trazem para cá.
Fontes: huntress.com ↗ itsecurityguru.org ↗
Between November 8 and 10, 2026, threat actors exploited internet-exposed GeoVision surveillance/webcam software to break into corporate networks and deploy the XMRig Monero cryptominer. Huntress SOC first observed the activity on November 8 and counted 13 organizations across various sectors (huntress.com, itsecurityguru.org). The intrusion starts with GeoStartupAgentService.exe, which runs with SYSTEM privileges on internet-facing devices and spawns command shells (huntress.com, itsecurityguru.org). The attackers then disable Microsoft Defender and install a resilient custom Golang loader that uses BitTorrent DHT for command and control, which complicates takedown (itsecurityguru.org). The sources do not name a specific vulnerability or CVE, or any threat actor.
Detalhes técnicos
- Initial execution: GeoStartupAgentService.exe spawns command shells that run PowerShell download cradles, which fetch and execute malicious scripts from a remote server (huntress.com).
- Reconnaissance and defense evasion: the scripts perform reconnaissance and try to disable Microsoft Defender through IFEO (Image File Execution Options) Debugger registry hijacks (huntress.com, itsecurityguru.org).
- Vulnerable driver (BYOVD): a vulnerable kernel driver (kvckiller.sys / wsftprm.sys) is deployed to tamper with antivirus protections (huntress.com, itsecurityguru.org).
- Loader: a custom Golang loader, update.exe, resolves its infrastructure dynamically using BitTorrent DHT and PKARR (huntress.com). It persists through scheduled tasks and relaunches itself to mine Monero with victim resources (huntress.com, itsecurityguru.org).
- Impact: XMRig cryptomining on compromised hosts, in 13 organizations (huntress.com, itsecurityguru.org).
Remediação
- Remove internet exposure from GeoVision devices (itsecurityguru.org, attributing the advice to Huntress).
- Monitor for unusual activity involving GeoStartupAgentService.exe and the processes it spawns (itsecurityguru.org).
- Based on the technical details above, defenders can also look for PowerShell download cradles launched from the GeoVision service, IFEO Debugger registry changes, the kvckiller.sys/wsftprm.sys drivers, update.exe, and new scheduled tasks. The sources do not list formal IOCs.
Linha do tempo
-
GeoVision Camera Software Exploited to Deploy XMRig Cryptominer via PowerShell and IFEO Hijacks
ler a análise desta fonte ocultar
Between November 8 and 10, 2026, threat actors exploited publicly exposed GeoVision webcam software to deploy the XMRig cryptominer across multiple organizations. The attack chain began with the GeoStartupAgentService.exe spawning command shells running PowerShell download cradles that fetched and executed malicious scripts from a remote server. These scripts conducted reconnaissance, attempted to disable Microsoft Defender via IFEO Debugger registry hijacks and deployed a vulnerable driver (kvckiller.sys/wsftprm.sys) to tamper with antivirus protections. A custom Golang loader (update.exe) was then executed, leveraging BitTorrent DHT and PKARR for dynamic infrastructure resolution, and persisted via scheduled tasks. The campaign impacted 13 organizations across various sectors, illustrating the risks of internet-exposed surveillance systems.
-
Attackers Exploit Internet-Exposed GeoVision CCTV Software to Disable Defender and Deploy XMRig Cryptominer
ler a análise desta fonte ocultar
Threat actors have been exploiting exposed GeoVision surveillance software instances to infiltrate corporate networks, disable Microsoft Defender, and install cryptomining malware, specifically XMRig. The campaign was first observed by Huntress SOC on November 8, 2026, affecting 13 organizations across various sectors. The intrusion vector involves the GeoStartupAgentService.exe running with SYSTEM privileges on internet-facing devices. Attackers deploy PowerShell scripts that disable Defender via a vulnerable kernel driver and Image File Execution Options hijacking before installing a resilient Go-based custom loader. This loader uses BitTorrent DHT for command and control, complicating takedown efforts, and persistently relaunches itself to mine Monero using victim resources. Huntress advises organizations to secure GeoVision devices by removing internet exposure and monitoring unusual activity related to GeoStartupAgentService.exe and connected processes.