---
id: "CMP-202611-alixma"
page: "https://infrastack.ai/live/CMP-202611-alixma"
kind: "campaign"
aliases: []
title: "Attackers hitting GeoVision camera software at multiple organizations in waves (Huntress SOC, details still emerging)"
severity: "high"
cvss: null
epss: null
exploited: true
status: "open"
category: "vendor"
products: [{"name": "GeoVision camera software (GV-VMS and related)", "fixed": [], "vendor": "GeoVision", "affected": ""}]
ecosystems: []
tags: ["campaign", "early-warning"]
not_affected_if: []
published_at: null
first_seen_at: "2026-11-08T21:03:21+00:00"
updated_at: "2026-11-08T21:05:14+00:00"
sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-11-08T21:03:21+00:00"}]
exploit_sources: []
---

# Attackers hitting GeoVision camera software at multiple organizations in waves (Huntress SOC, details still emerging)

Link for people: https://infrastack.ai/live/CMP-202611-alixma (this .md is for agents)

On 8 Nov 2026 Huntress said its SOC spent the morning investigating a couple of waves of attacker activity involving GeoVision camera software across multiple organizations, and is still monitoring. Which GeoVision product, which flaw or access route, and what the attackers did afterwards are unknown so far; Huntress has not published a write-up yet. Not yet tied to the earlier Huntress CMS.exe camera-software campaign (CMP-202610-attackers-break-in-through-windows-camera-management-softwar), which named no vendor.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- :GeoVision camera software (GV-VMS and related) affected range not listed fixed no fixed version listed

## Cause

How the attacker got in: not disclosed yet (unknown). The summary says the flaw or access route is unknown so far and Huntress has not published a write-up, and it does not say how the incident reached users, customers or dependents.

How it reached others: not stated (unknown).

Last month's incidents with the same cause, and the full checklist: https://infrastack.ai/live/causes.md#unknown

## How to check

Find every host running GeoVision software (such as GV-VMS, WebCam Server, GeoWebPlayer) and any GeoVision cameras or NVRs. Hunt in firewall, proxy, EDR and server logs for connections to or from 45.32.117[.]34 and 156.246.94[.]183 (the IPs Huntress gives). Look for unusual child processes started by GeoVision processes. Other indicators: unknown.

## Fix

Take GeoVision software and devices off the internet, or allow access only through a VPN or trusted IPs, and keep them apart from the rest of the network. Block 45.32.117[.]34 and 156.246.94[.]183. Install the latest GeoVision updates. If you find these IPs in your logs, isolate the host and change the passwords used on it. No specific vendor fix is known.

## Timeline

- 2026-11-08T21:03:21+00:00 analyst

## Documents

- [describes] @HuntressLabs: A busy morning for our SOC as we investigated a couple waves of activity across  https://x.com/HuntressLabs/status/2119535643466572220

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_