Attackers Exploit Internet-Exposed GeoVision CCTV Software to Disable Defender and Deploy XMRig Cryptominer
Threat actors have been exploiting exposed GeoVision surveillance software instances to infiltrate corporate networks, disable Microsoft Defender, and install cryptomining malware, specifically XMRig. The campaign was first observed by Huntress SOC on November 8, 2026, affecting 13 organizations across various sectors. The intrusion vector involves the GeoStartupAgentService.exe running with SYSTEM privileges on internet-facing devices. Attackers deploy PowerShell scripts that disable Defender via a vulnerable kernel driver and Image File Execution Options hijacking before installing a resilient Go-based custom loader. This loader uses BitTorrent DHT for command and control, complicating takedown efforts, and persistently relaunches itself to mine Monero using victim resources. Huntress advises organizations to secure GeoVision devices by removing internet exposure and monitoring unusual activity related to GeoStartupAgentService.exe and connected processes.
Linha do tempo
-
Attackers Exploit Internet-Exposed GeoVision CCTV Software to Disable Defender and Deploy XMRig Cryptominer
ler a análise desta fonte ocultar
Threat actors have been exploiting exposed GeoVision surveillance software instances to infiltrate corporate networks, disable Microsoft Defender, and install cryptomining malware, specifically XMRig. The campaign was first observed by Huntress SOC on November 8, 2026, affecting 13 organizations across various sectors. The intrusion vector involves the GeoStartupAgentService.exe running with SYSTEM privileges on internet-facing devices. Attackers deploy PowerShell scripts that disable Defender via a vulnerable kernel driver and Image File Execution Options hijacking before installing a resilient Go-based custom loader. This loader uses BitTorrent DHT for command and control, complicating takedown efforts, and persistently relaunches itself to mine Monero using victim resources. Huntress advises organizations to secure GeoVision devices by removing internet exposure and monitoring unusual activity related to GeoStartupAgentService.exe and connected processes.