Camera software used to sideload malware on Windows
Huntress saw a suspected reverse shell and one shared command server across several customers, with no CVE identified.
68
Malware
IPHLPAPI.DLL
- Mentions · 7d2
- Mentions · 30d2
- All mentions2
- First seenOct 28, 2026
- Last mentioned2d ago
Timeline
2 articles · newest firstCamera software intrusions drop reverse shells and sideloaded DLLs
Huntress tied September and October cases to one C2 after CMS.exe launched a user-writable reverse shell and relocated WpcMon.exe.
68
Appears with
- CMS.exeproduct · 2
- Huntressorganization · 2
- Microsoftvendor · 2
- samcli.dllmalware · 2
- WpcMon.exeproduct · 1
- Windows Parental Control Monitorproduct · 1
- rs.win32.exemalware · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.