GeoVision CCTV Software Exploited to Deploy Cryptominers and Disable Defender

• •Attackers exploited GeoVision software to disable Microsoft Defender and deploy cryptominers.
• •Thirteen organizations across various industries were affected by the attacks.
• •Malicious activity involved PowerShell scripts and a vulnerable kernel driver to bypass security measures.

Hackers are exploiting vulnerabilities in GeoVision surveillance software to infiltrate corporate networks, disable Microsoft Defender, and install XMRig cryptomining malware. The Huntress SOC reported that the attacks began on November 8, 2026, with 13 organizations affected across various industries. The malicious activity is traced back to GeoStartupAgentService.exe, which was running with SYSTEM privileges on many machines. Attackers used PowerShell scripts to download a vulnerable kernel driver, wsftprm.sys, to bypass antivirus protections. They also hijacked Windows security components using Image File Execution Options (IFEO) to prevent Defender from launching. The final payload included a custom loader that connects to a BitTorrent network for resilience, allowing it to evade detection and re-establish connections. The campaign highlights the need for organizations to secure camera management software as part of their cybersecurity posture.