Attackers Exploit Exposed GeoVision Software to Deploy XMRig Cryptominer
Summary
Huntress reports attackers exploited publicly exposed GeoVision software at 13 organizations, using PowerShell, a vulnerable driver and Windows security-process hijacks to deploy a custom loader and XMRig miner.
Key points
- Huntress observed malicious activity across 13 organizations, with affected endpoints linked to publicly exposed GeoVision devices or management interfaces.
- GeoStartupAgentService.exe spawned command shells that launched PowerShell scripts, which checked for writable directories and Microsoft Defender.
- A script downloaded wsftprm.sys, also identified as kvckiller.sys, a vulnerable driver previously abused to tamper with antivirus protections.
- Attackers configured IFEO Debugger settings to redirect Microsoft Defender and Windows Security components to systray.exe, likely interfering with their launch.
- A custom Go loader used BitTorrent Mainline DHT and a PKARR resolver to locate infrastructure, and created scheduled tasks on some endpoints for persistence.
- The loader downloaded XMRig as ApplyUpdate.exe to mine cryptocurrency using compromised systems' compute resources.
- Huntress recommends restricting public access to GeoVision devices, checking for the described process and network activity, and isolating affected hosts while preserving evidence.
Article Details
- Attack Vectors
- Attackers exploited publicly exposed GeoVision webcam software or management interfaces; the activity originated from GeoStartupAgentService.exe.
- The GeoVision service spawned cmd.exe, which launched PowerShell to retrieve and execute scripts from a remote server, including scripts run in memory and one launched using WMI.
- PowerShell scripts searched for writable directories, checked whether Microsoft Defender was active, and downloaded a vulnerable kernel-mode driver identified as wsftprm.sys and named kvckiller.sys in the incident.
- Attackers configured Image File Execution Options (IFEO) Debugger registry settings for Microsoft Defender and Windows Security components, redirecting their launches to systray.exe.
- A custom Golang loader used a BitTorrent Mainline DHT client and PKARR resolver to locate server addresses, downloaded XMRig as ApplyUpdate.exe, and on some endpoints created scheduled tasks to restart the loader.
- XMRig was deployed on affected endpoints to mine cryptocurrency using their compute resources.
- Defensive Notes
- Remove unnecessary public access to GeoVision devices and management interfaces; place them behind a VPN or restrict access to trusted IP addresses.
- Look for unexpected command shells or PowerShell launched by GeoStartupAgentService.exe, and review the indicators in the advisory.
- Investigate DNS queries to 8.8.8[.]8, 8.8.4[.]4, or 1.1.1[.]1 initiated by processes other than the system DNS client, and outbound UDP DHT traffic on port 6881 or similar from a GeoVision server or WebCamServer.exe.
- Look for schtasks /Create commands launched by update.exe and scheduled tasks named PackageUpdater or PackageUpdater_Startup.
- If malicious activity is found, isolate affected hosts and preserve evidence before removing files or changing configurations.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | cctv-update[.]top | Domain associated with the IP address contacted by update.exe. |
| IPV4 | 156[.]246[.]94[.]183 | IP address contacted by the custom Golang loader update.exe. |
| IPV4 | 2[.]59[.]133[.]151 | IP address that WebCamServer.exe was observed contacting; the article describes it as a likely source of exploitation. |
| IPV4 | 45[.]32[.]117[.]34 | Server hosting the PowerShell scripts retrieved and launched during the attack. |
| SHA256 | b673c4d707828abedc767a2be6badef7454492e62c37e30cf3cc5a402fd3647b | SHA-256 hash of PowerShell scripts observed in the attacks. |
| SHA256 | f1235751c9e48e5732b7b183dc2bb175a19e4c6401dfd0e96b4cfdd0d8c54b4c | SHA-256 hash of the custom Golang loader update.exe. |
| SHA256 | ff5dbdcf6d7ae5d97b6f3ef412df0b977ba4a844c45b30ca78c0eeb2653d69a8 | SHA-256 hash of the vulnerable driver abused in the incident. |
MITRE ATT&CK
T1053.005 · Scheduled TaskPackageUpdater ran update.exe every 15 minutes, and PackageUpdater_Startup ran at system startup on some endpoints.T1059.001 · PowerShellPowerShell download cradles retrieved and launched the attack scripts.T1059.003 · Windows Command ShellGeoStartupAgentService.exe spawned cmd.exe to launch PowerShell.T1083 · File and Directory DiscoveryScripts a and b searched endpoints for writable directories.T1105 · Ingress Tool TransferScript b downloaded kvckiller.sys, script c downloaded update.exe, and update.exe downloaded XMRig as ApplyUpdate.exe.T1112 · Modify RegistryThe attacker wrote IFEO Debugger settings to Windows Registry keys for Microsoft Defender and Windows Security executables.T1190 · Exploit Public-Facing ApplicationThe attacker exploited publicly exposed GeoVision webcam software on endpoints associated with exposed devices or management interfaces.T1496.001 · Compute HijackingThe attacker deployed XMRig as ApplyUpdate.exe to mine cryptocurrency using compute resources on exploited endpoints.T1518.001 · Security Software DiscoveryScript a checked whether Microsoft Defender was active in the victim environment.T1546.012 · Image File Execution Options InjectionIFEO Debugger settings redirected launches of MsMpEng.exe, SecurityHealthService.exe, and SecurityHealthSystray.exe to systray.exe.T1568 · Dynamic ResolutionThe update.exe loader used a BitTorrent Mainline DHT client and PKARR resolver to find server addresses and support infrastructure changes.T1608.001 · Upload MalwareThe attacker hosted PowerShell scripts a, b, and c on 45.32.117[.]34 for exploited endpoints to retrieve and launch.T1685 · Disable or Modify ToolsThe scripts attempted to disable Microsoft Defender, and the IFEO settings likely interfered with the launch of security components.
People
Cristian PoenaruAcknowledged for contributions to the analysis and triage associated with the investigation.Harry GodridgeAcknowledged for contributions to the analysis and triage associated with the investigation.Tanner FilipAcknowledged for contributions to the analysis and triage associated with the investigation.Zach RogersAcknowledged for contributions to the analysis and triage associated with the investigation.
Malware
Vendors
GeoVisionHomeBlogThreat Advisory: GeoVision Camera Software Exploited to Drop XMRigMicrosoftWe observed a.ps1 being detonated in memory before searching for writable directories and checking if Microsoft Defender is active on the victim's environment. The secondary script (b.ps1) was written to disk before
Products
GeoVision webcam softwareThe Huntress SOC observed widespread malicious activity stemming from GeoVision webcam software this week, with the bulk of the attacks occurring between November 8 and November 10. GeoVision is a Taiwanese surveillanceMicrosoft Defender Antimalware Platformobserved a.ps1 being detonated in memory before searching for writable directories and checking if Microsoft Defender is active on the victim's environment. The secondary script (b.ps1) was written to disk before