GeoVision Camera Software Abused to Deploy XMRig Cryptominer

Attackers leveraged publicly exposed GeoVision camera software—likely running outdated or unpatched versions—to gain a foothold across 13 organizations and deploy the XMRig cryptominer. The attack chain was sophisticated: PowerShell scripts attempted to disable Microsoft Defender via a kernel-mode driver and IFEO debugger hijacks, followed by a custom Golang loader to fetch and execute the miner. This incident highlights the danger of internet-facing legacy or IoT devices that are rarely patched and often overlooked in vulnerability management programs. Organizations frequently underestimate the risk posed by peripheral devices like cameras, which can serve as effective entry points into broader network environments.