Compromised camera software used to deploy malware, Huntress says
Original title: Camera Management Software Compromise Leads to Malware Deployment
In September and October cases, attackers dropped rs.win32.exe, sideloaded DLLs with WpcMon.exe, and beaconed to a C2 host.
Huntress says multiple customer incidents in September and October began with compromised camera management software, CMS.exe. Attackers then placed rs.win32.exe in a user AppData path, launched what analysts assessed as a reverse shell, and copied legitimate Microsoft WpcMon.exe into AppData to sideload malicious DLLs. The activity set Run key persistence and beaconed to 144.172.116[.]37. Huntress could not identify the CMS vendor or how initial access was gained.
Unconfirmed: Huntress could not confirm the CMS vendor, a kvision[.]ai relationship, or the initial-access method.
- CMS.exe was found under Program Files (x86)\CMS and contained a 3r-dataware[.]com string.
- A kvision[.]ai CMS package is only a possible source, not a confirmed vendor link.
- rs.win32.exe ran from AppData\Roaming\CMS\RemoteSetup toward a remote host on port 8000.
- Legitimate WpcMon.exe was placed in AppData rather than its normal System32 location.
- Huntress advises restricting CMS access and checking unusual process chains and outbound connections.
Impact: Malware execution and remote control after CMS compromise
| Product | Affected |
|---|---|
| CMS.exe | — |
- 1.Inventory and restrict access to camera management software.
- 2.Prevent executables and DLLs from running in user-writable paths where possible.
- 3.Investigate unusual process chains and outbound connections from CMS hosts.
- Products
- CMS.exeWpcMon.exe
- Malware
- rs.win32.exe
- Organizations
- Huntress
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | 3r-dataware.com | rslavery d3e3v4e3l9o9p0e3r4s2l9a1v4e3r4y6 hxxp://cloudapi.3r-dataware[.]com/sso/ The domain name 3r-dataware[.]com (pointing to a Ko |
| domain | for3r-dataware.com | the domain name. Figure 1: Whois results/VirusTotal search for3r-dataware[.]com Figure 2 illustrates the software download page at the k |
| domain | kvision.ai | com Figure 2 illustrates the software download page at the kvision[.]ai website, pointing to a package named "CMS". Figure 2:Kvi |
| domain | kvision.aisoftware | [.]ai website, pointing to a package named "CMS". Figure 2:Kvision[.]aisoftware download page Upon closer inspection of the CMS file dow |
| ipv4 | 144.172.116.37 | dents, the C2 IP address observed on impacted endpoints was 144.172.116[.]37, which is shown in Figure 6. Figure 6: Active network co |
| sha256 | 1fb4af4862643dcab1459872f723f574f1a588855b020916b600df5c20681144 | Compromise Indicator Description Rs.win32.exe SHA256: 1fb4af4862643dcab1459872f723f574f1a588855b020916b600df5c20681144 File dropped in users' AppData folder path samcli.dll SHA |
| sha256 | 70b2345302264c41504d59e6a63d6d908969740424b42b7373f10b4c8d74c87a | cca1902acdc3d4b1fd1035 Malicious DLL IPHLPAPI.DLL SHA256: 70b2345302264c41504d59e6a63d6d908969740424b42b7373f10b4c8d74c87a Malicious DLL 144.172.116[.]37 C2 IP address • Summar |
| sha256 | 8f8e88c54a9c56174974711eff99b4beb79536642fcca1902acdc3d4b1fd1035 | dropped in users' AppData folder path samcli.dll SHA256: 8f8e88c54a9c56174974711eff99b4beb79536642fcca1902acdc3d4b1fd1035 Malicious DLL IPHLPAPI.DLL SHA256: 70b2345302264c41504d59 |
| url | http://cloudapi.3r-dataware.com/sso/ | rings: developerslavery d3e3v4e3l9o9p0e3r4s2l9a1v4e3r4y6 hxxp://cloudapi.3r-dataware[.]com/sso/ The domain name 3r-dataware[.]com (pointing to a Korean |
From the original article
8 min read at huntress.comAttackers compromised camera management software to deploy malware, establish persistence, and beacon to C2. Huntress breaks down the attack chain and IOCs.
huntress.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.