[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fF3e-_suiBTYI1DllySV1WMxUwaB1fdkXSg7ggSdGjns":3},{"article":4,"iocs":48,"watch_terms":66,"solutions":67,"lesson":148},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"e9de5e31-510f-4869-ab91-6176a3b50ed1","GeoVision Camera Software Abused to Deploy XMRig Cryptominer","geovision-camera-software-abused-to-deploy-xmrig-cryptominer-5493e9","Attackers abused publicly exposed GeoVision camera software at 13 organizations, tried to disable Defender, and deployed XMRig. Get the IoCs and next steps.","Attackers exploited publicly exposed GeoVision camera software across 13 organizations to deploy the XMRig cryptominer. The attack chain involved PowerShell scripts that attempted to disable Microsoft Defender using a kernel-mode driver and IFEO debugger hijacks. A custom Golang loader was then used to download and execute the miner.","GeoVision camera software exploited to deploy XMRig cryptominer and disable Defender.","https:\u002F\u002Fwww.huntress.com\u002Fblog\u002Fgeovision-camera-software-xmrig-cryptominer","https:\u002F\u002Fcdn.builder.io\u002Fapi\u002Fv1\u002Fimage\u002Fassets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2Fd0f2eecb96d24faaa5a9ae527886ba4d","2026-11-13T14:00:00+00:00","2026-11-13T21:00:35.476402+00:00",8,[17,20,23,26,28],{"name":18,"type":19},"GeoVision","vendor",{"name":21,"type":22},"GeoStartupAgentService.exe","product",{"name":24,"type":25},"XMRig","technology",{"name":27,"type":25},"PowerShell",{"name":29,"type":25},"Microsoft Defender","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":30,"icon":32,"name":33,"slug":34},null,"Malware","malware",[36,41,43],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":42},{"id":30,"icon":32,"name":33,"slug":34},{"category":44},{"id":45,"icon":32,"name":46,"slug":47},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[49,53,57,61,64],{"type":50,"value":51,"context":52},"url","http:\u002F\u002F45.32.117[.]34\u002Fa","Initial PowerShell download URL",{"type":54,"value":55,"context":56},"domain","cctv-update.top","Domain associated with the Golang loader",{"type":58,"value":59,"context":60},"ip","45.32.117.34","IP address hosting initial PowerShell scripts",{"type":58,"value":62,"context":63},"156.246.94.183","IP address associated with the Golang loader",{"type":34,"value":24,"context":65},"Cryptominer deployed by attackers",[18,21],{"controls":68,"vendors":147},[69,97,118],{"slug":70,"name":71,"problem":72,"products":73},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[74,81,89],{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":76,"url":79,"description":80},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"slug":98,"name":99,"problem":100,"products":101},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[102,110],{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":119,"name":120,"problem":121,"products":122},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[123,131,139],{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":140,"vendor_name":141,"vendor_logo":142,"product_slug":143,"product_name":144,"url":145,"description":146},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",[],{"slug":149,"title":150,"body":151,"framework_refs":152,"framework_notes":158},"exposed-camera-software-exploited-to-mine-cryptocurrency-across-13-organizations","Exposed Camera Software Exploited to Mine Cryptocurrency Across 13 Organizations","Attackers leveraged publicly exposed GeoVision camera software—likely running outdated or unpatched versions—to gain a foothold across 13 organizations and deploy the XMRig cryptominer. The attack chain was sophisticated: PowerShell scripts attempted to disable Microsoft Defender via a kernel-mode driver and IFEO debugger hijacks, followed by a custom Golang loader to fetch and execute the miner. This incident highlights the danger of internet-facing legacy or IoT devices that are rarely patched and often overlooked in vulnerability management programs. Organizations frequently underestimate the risk posed by peripheral devices like cameras, which can serve as effective entry points into broader network environments.",[153,154,155,156,157],"CIS Control 1: Inventory and Control of Enterprise Assets (v8)","CIS Control 7: Continuous Vulnerability Management (v8)","NIST SP 800-53 SI-2: Flaw Remediation","MITRE ATT&CK T1562.001: Impair Defenses: Disable or Modify Tools","NIS2 Article 21(2)(e)",{"NIS2 Article 21(2)(e)":159,"NIST SP 800-53 SI-2: Flaw Remediation":160,"CIS Control 7: Continuous Vulnerability Management (v8)":161,"CIS Control 1: Inventory and Control of Enterprise Assets (v8)":162,"MITRE ATT&CK T1562.001: Impair Defenses: Disable or Modify Tools":163},"The incident stemmed from unaddressed vulnerabilities in internet-facing software; NIS2 Article 21(2)(e) requires organizations to handle vulnerability disclosure and maintain security in acquisition and maintenance of systems.","Failure to patch or mitigate known vulnerabilities in internet-facing camera software allowed initial access; SI-2 requires organizations to identify, report, and correct information system flaws in a timely manner.","The attackers exploited publicly exposed, likely unpatched GeoVision software; CIS Control 7 requires continuously assessing and remediating vulnerabilities across all assets, including IoT and peripheral devices.","Internet-facing camera devices were exploited precisely because organizations lacked visibility into these assets; CIS Control 1 requires maintaining an accurate inventory of all hardware assets to ensure they are managed and secured.","The attackers used a kernel-mode driver and IFEO debugger hijacks specifically to disable Microsoft Defender, which maps directly to this technique of disabling security tools to evade detection."]