Huntress: compromised camera software used to enter corporate networks
September and October cases show CMS.exe launching a reverse shell and sideloading DLLs through a copied WpcMon.exe.
62
Product
CMS.exe
- Mentions · 7d4
- Mentions · 30d4
- All mentions4
- First seenOct 27, 2026
- Last mentioned2d ago
Timeline
4 articles · newest firstCamera software used to sideload malware on Windows
Huntress saw a suspected reverse shell and one shared command server across several customers, with no CVE identified.
68
Camera software intrusions drop reverse shells and sideloaded DLLs
Huntress tied September and October cases to one C2 after CMS.exe launched a user-writable reverse shell and relocated WpcMon.exe.
68
Compromised camera software used to deploy malware, Huntress says
In September and October cases, attackers dropped rs.win32.exe, sideloaded DLLs with WpcMon.exe, and beaconed to a C2 host.
64
Appears with
- Huntressorganization · 4
- WpcMon.exeproduct · 3
- rs.win32.exemalware · 3
- Microsoftvendor · 2
- IPHLPAPI.DLLmalware · 2
- samcli.dllmalware · 2
- Windows Parental Control Monitorproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.