Hackers exploit exposed GeoVision CCTV software to disable Defender and deploy cryptominers

Threat actors are abusing internet-exposed GeoVision surveillance software to break into corporate networks, disable Microsoft Defender, and quietly install cryptomining malware, according to new research from Huntress.

The Huntress Security Operations Centre (SOC) began seeing the activity on 8 November, with most attacks landing between 8 and 10 November and activity continuing over the past week. So far, 13 organisations across a range of industries have been affected. GeoVision is a Taiwanese surveillance and access-control vendor.

Every incident traced back to the same source: GeoStartupAgentService.exe, a GeoVision service that on many machines was running with full SYSTEM privileges. Searches of the victims’ external IP addresses on Shodan showed GeoVision devices or management interfaces sitting openly on the internet.

Blinding the defences first

Once the attackers had a foothold, the GeoVision service spawned a command shell that pulled down a chain of PowerShell scripts from an attacker-controlled server. Before installing their payload, the attackers worked to disarm the victim’s security tools.

The scripts checked whether Microsoft Defender was running and downloaded a vulnerable kernel driver, wsftprm.sys (disguised as kvckiller.sys), which has previously been abused in Bring Your Own Vulnerable Driver (BYOVD) attacks to tamper with antivirus. The attackers also used Image File Execution Options (IFEO), a legitimate Windows debugging feature, to hijack the Defender antivirus engine and Windows Security components. This redirected them to launch systray.exe instead, likely to stop the protections from starting at all.