Threat Actors Exploit GeoVision Surveillance Software to Compromise Corporate Networks
Recent findings from Huntress reveal a disturbing trend of cybercriminals exploiting vulnerabilities in internet-exposed GeoVision surveillance software to infiltrate corporate networks, disable critical security measures like Microsoft Defender, and covertly install cryptomining malware. This alarming discovery highlights the growing sophistication of cyber threats and the necessity for organizations to reassess their security protocols.
The cybersecurity firm Huntress began tracking the malicious activity on November 8. The bulk of the attacks occurred within a narrow window from November 8 to 10, yet the activity has persisted beyond this initial surge. So far, 13 organizations across various sectors have reported incidents linked to these exploits. GeoVision, a Taiwanese vendor specializing in surveillance and access-control technologies, has become the focal point of this alarming trend.
Investigations into the incidents revealed a common thread: all attacks traced back to GeoStartupAgentService.exe, a GeoVision service that, on several machines, was operating with full SYSTEM privileges. This raised significant concerns about the security implementations within the software. A closer look at the affected organizations’ external IP addresses through Shodan, a search engine for internet-connected devices, displayed GeoVision devices or management interfaces accessible without restriction on the open internet, creating a veritable invitation for attackers.
Disabling Security Measures
Once the attackers established a foothold, they utilized the GeoVision service to spawn a command shell, which fetched a series of PowerShell scripts from a server controlled by the attackers. The first step in their malicious agenda involved neutralizing the victims’ security defenses. The scripts were designed to check if Microsoft Defender was operational. Subsequently, the attackers downloaded a vulnerable kernel driver, wsftprm.sys—concealed under the guise of kvckiller.sys. This driver has been previously leveraged in Bring Your Own Vulnerable Driver (BYOVD) attacks, which are aimed at undermining antivirus software.
In a clever maneuver, the attackers employed Image File Execution Options (IFEO)—a legitimate Windows debugging feature—to hijack the processes of the Defender antivirus engine and Windows Security. This manipulation directed the system to launch systray.exe instead, effectively preventing the security measures from activating.
A Persistent Threat
With the defenses of their targets weakened, the attackers deployed a final script that installed a custom loader programmed in Go. This loader made contact with infrastructure affiliated with the domain cctv-update[.]top, which was registered on November 7, just a day before the onset of the attacks.
What sets the loader apart is its remarkable resilience. It incorporates a BitTorrent Mainline DHT client and a PKARR resolver, enabling it to locate the attackers’ current servers through a public key on the BitTorrent peer-to-peer network. This design means the attackers can shift their infrastructure without the necessity of acquiring new domains, rendering efforts to take down their servers less effective.
To further entrench their presence, the loader created scheduled tasks named PackageUpdater and PackageUpdater_Startup, programmed to relaunch itself every 15 minutes and upon system boot. The final act involved installing the XMRig cryptominer, cunningly disguised as ApplyUpdate.exe, allowing the attackers to commandeer the victim organizations’ computing power for illicit cryptocurrency mining operations.
Reconceptualizing Security Measures
Huntress has identified this campaign as the latest in a series of attacks targeting camera systems, urging organizations to treat camera management software as an integral part of their enterprise attack surface rather than viewing it merely as a separate concern related to building security.
To bolster defenses, Huntress recommends a series of actionable steps for organizations utilizing GeoVision software:
-
Minimize Internet Exposure: Ensure that GeoVision devices and management interfaces are not unnecessarily exposed to the internet. Implement VPNs or restrict access to trusted IP addresses.
-
Investigate Anomalies: Conduct thorough investigations into any unexpected command shells or PowerShell activity instigated by GeoStartupAgentService.exe.
-
Monitor Specific Traffic: Be vigilant for outbound UDP DHT traffic, particularly on port 6881 or related ports, originating from the GeoVision process WebCamServer.exe, along with DNS queries to public resolvers that are initiated by processes outside the system DNS client.
- Isolate Affected Hosts: If any hosts are suspected of compromise, isolate them while preserving evidence before altering any files or configurations.
To access the complete advisory, including indicators of compromise and MITRE ATT&CK mappings, organizations can refer to the detailed blog post on the Huntress website.
The emergence of this threat underlines the necessity for proactive and comprehensive cybersecurity strategies, particularly as cyber adversaries continue to exploit vulnerabilities in software that many may consider outside the realm of critical security concern.