Camera software intrusions drop reverse shells and sideloaded DLLs
Original title: Hackers Hijack Camera Management Software to Deploy Reverse Shells and Hidden Windows Malware
Huntress tied September and October cases to one C2 after CMS.exe launched a user-writable reverse shell and relocated WpcMon.exe.
Huntress investigated several September and October intrusions involving CMS.exe, a camera management application under C:\Program Files (x86)\CMS\. After compromise, attackers ran rs.win32.exe from a user-writable directory with remote connectivity that Huntress interpreted as reverse-shell activity, then sideloaded modified DLLs through a legitimate copy of Microsoft’s WpcMon.exe. The genuine binary was added to the user’s Run key so it started at sign-in. Endpoints contacted 144.172.116[.]37. The initial access method and the software vendor remain unconfirmed.
Unconfirmed: The vendor relationship and how attackers first compromised the camera application are unconfirmed.
- CMS.exe lacked File Version Information, so Huntress could not identify its vendor.
- Strings matched a package on kvision[.]ai, but that does not prove the download source.
- Malicious IPHLPAPI.DLL and samcli.dll were modified zlib libraries with beaconing code.
- WpcMon.exe was placed under AppData rather than C:\Windows\System32 and verified by SHA256.
- Huntress published SHA256 values for rs.win32.exe and both malicious DLLs.
Impact: Remote access, beaconing, and user-level persistence
| Product | Affected |
|---|---|
| CMS.exe camera management application | — |
- 1.Inventory camera management applications, restrict access, and monitor execution and outbound traffic.
- 2.Block unapproved executables and DLLs from running in user-writable directories.
- 3.Hunt for the published SHA256 indicators, unexpected WpcMon.exe paths, Run-key changes, and the reported C2.
- Vendors
- Microsoft
- Products
- CMS.exeWpcMon.exe
- Organizations
- Huntress
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | 3r-dataware.com | cated variation of that string, and a reference to cloudapi.3r-dataware[.]com/sso/. Huntress found matching strings and the same domain |
| domain | kvision.ai | he same domain reference in a CMS package available through kvision[.]ai. Although domain registration information pointed toward |
| sha256 | 1fb4af4862643dcab1459872f723f574f1a588855b020916b600df5c20681144 | rs of Compromise Indicator Description Rs.win32.exe SHA256: 1fb4af4862643dcab1459872f723f574f1a588855b020916b600df5c20681144 File dropped in users’ AppData folder path samcli.dll SHA25 |
| sha256 | 70b2345302264c41504d59e6a63d6d908969740424b42b7373f10b4c8d74c87a | 2fcca1902acdc3d4b1fd1035 Malicious DLL IPHLPAPI.DLL SHA256: 70b2345302264c41504d59e6a63d6d908969740424b42b7373f10b4c8d74c87a Malicious DLL Note: IP addresses and domains are intentiona |
| sha256 | 8f8e88c54a9c56174974711eff99b4beb79536642fcca1902acdc3d4b1fd1035 | le dropped in users’ AppData folder path samcli.dll SHA256: 8f8e88c54a9c56174974711eff99b4beb79536642fcca1902acdc3d4b1fd1035 Malicious DLL IPHLPAPI.DLL SHA256: 70b2345302264c41504d59e6 |
From the original article
3 min read at gbhackers.com
Attackers are compromising camera management software to gain remote access, run malicious DLLs through a legitimate Windows component, and maintain persistent footholds in enterprise environments. The incidents show how overlooked surveillance applications can become entry points into broader corporate networks. Huntress observed several intrusions during September and October involving CMS.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.