{"id":"CMP-202611-alixma","kind":"campaign","aliases":[],"related":[],"title":"Attackers hitting GeoVision camera software at multiple organizations in waves (Huntress SOC, details still emerging)","description":null,"summary":"On 8 Nov 2026 Huntress said its SOC spent the morning investigating a couple of waves of attacker activity involving GeoVision camera software across multiple organizations, and is still monitoring. Which GeoVision product, which flaw or access route, and what the attackers did afterwards are unknown so far; Huntress has not published a write-up yet. Not yet tied to the earlier Huntress CMS.exe camera-software campaign (CMP-202610-attackers-break-in-through-windows-camera-management-softwar), which named no vendor.","severity":"high","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-11-08T21:03:21+00:00","products":[{"name":"GeoVision camera software (GV-VMS and related)","fixed":[],"vendor":"GeoVision","affected":""}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"Find every host running GeoVision software (such as GV-VMS, WebCam Server, GeoWebPlayer) and any GeoVision cameras or NVRs. Hunt in firewall, proxy, EDR and server logs for connections to or from 45.32.117[.]34 and 156.246.94[.]183 (the IPs Huntress gives). Look for unusual child processes started by GeoVision processes. Other indicators: unknown.","fix":"Take GeoVision software and devices off the internet, or allow access only through a VPN or trusted IPs, and keep them apart from the rest of the network. Block 45.32.117[.]34 and 156.246.94[.]183. Install the latest GeoVision updates. If you find these IPs in your logs, isolate the host and change the passwords used on it. No specific vendor fix is known.","status":"open","published_at":null,"first_seen_at":"2026-11-08T21:03:21+00:00","triaged_at":"2026-11-08T21:03:21+00:00","updated_at":"2026-11-08T21:05:14+00:00","category":"vendor","confidence":null,"triage":{"cause":{"at":"2026-11-08T21:04:09Z","path":"unknown","entry":"unknown","reason":"The summary says the flaw or access route is unknown so far and Huntress has not published a write-up, and it does not say how the incident reached users, customers or dependents.","confidence":0.9}},"analyst_status":"done","analyst_note":null,"search":"'-202610':101B '-202611':17A '2026':34B '8':32B 'access':67B 'across':54B 'activ':49B 'afterward':74B 'alixma':18A 'and':25A 'attack':1A,48B,72B,103B 'attackers-break-in-through-windows-camera-management-softwar':102B 'break':104B 'camera':4A,20A,52B,97B,108B 'camera-softwar':96B 'campaign':27B,99B 'cmp':16A,100B 'cms.exe':95B 'coupl':44B 'detail':13A 'earli':29B 'earlier':93B 'early-warn':28B 'emerg':15A 'far':78B 'flaw':65B 'geovis':3A,51B,62B 'geovision':19A 'gv':23A 'gv-vms':22A 'hit':2A 'huntress':11A,35B,79B,94B 'investig':42B 'involv':50B 'manag':109B 'monitor':60B 'morn':41B 'multipl':7A,55B 'name':112B 'nov':33B 'organ':8A,56B 'product':63B 'publish':82B 'related':26A 'rout':68B 'said':36B 'soc':12A,38B 'softwar':5A,53B,98B,110B 'software':21A 'spent':39B 'still':14A,59B 'tie':90B 'unknown':76B 'vendor':114B 'vms':24A 'warn':30B 'wave':10A,46B 'window':107B 'write':85B 'write-up':84B 'yet':87B,89B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["camerasoftwaregvvmsandrelated","geovisioncamerasoftwaregvvmsandrelated"],"ptokens":["and","camera","geovision","gv","related","software","vms"],"labels":["campaign","earlywarning","high","vendor"],"campaign_type":"exploitation","search_a":"'-202611':17A 'alixma':18A 'and':25A 'attack':1A 'camera':4A,20A 'cmp':16A 'detail':13A 'emerg':15A 'geovis':3A 'geovision':19A 'gv':23A 'gv-vms':22A 'hit':2A 'huntress':11A 'multipl':7A 'organ':8A 'related':26A 'soc':12A 'softwar':5A 'software':21A 'still':14A 'vms':24A 'wave':10A","search_b":"'-202610':101B '2026':34B '8':32B 'access':67B 'across':54B 'activ':49B 'afterward':74B 'attack':48B,72B,103B 'attackers-break-in-through-windows-camera-management-softwar':102B 'break':104B 'camera':52B,97B,108B 'camera-softwar':96B 'campaign':27B,99B 'cmp':100B 'cms.exe':95B 'coupl':44B 'earli':29B 'earlier':93B 'early-warn':28B 'far':78B 'flaw':65B 'geovis':51B,62B 'huntress':35B,79B,94B 'investig':42B 'involv':50B 'manag':109B 'monitor':60B 'morn':41B 'multipl':55B 'name':112B 'nov':33B 'organ':56B 'product':63B 'publish':82B 'rout':68B 'said':36B 'soc':38B 'softwar':53B,98B,110B 'spent':39B 'still':59B 'tie':90B 'unknown':76B 'vendor':114B 'warn':30B 'wave':46B 'window':107B 'write':85B 'write-up':84B 'yet':87B,89B","search_c":"","cause_entry":"unknown","cause_path":"unknown","disclosures_checked_at":null,"first_public_at":"2026-11-08T21:00:51+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-alixma","url":null,"severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-08T21:03:21+00:00","fetched_at":"2026-11-08T21:03:21+00:00","note":null}],"documents":[{"id":103697,"url":"https://x.com/HuntressLabs/status/2119535643466572220","title":"@HuntressLabs: A busy morning for our SOC as we investigated a couple waves of activity across ","kind":"post","source":"x","publisher":null,"text":"A busy morning for our SOC as we investigated a couple waves of activity across multiple organizations involving GeoVision camera software. We continue to monitor the situation and recommend that defenders hunt for activity tied to IPs 45.32.117[.]34 and 156.246.94[.]183. https://t.co/OrIY2Kuy5B\n\nlikes 22 reposts 5","published_at":"2026-11-08T21:00:51+00:00","relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}