Huntress: compromised camera software used to enter corporate networks
Original title: Compromised camera management software gives attackers a way into corporate networks
September and October cases show CMS.exe launching a reverse shell and sideloading DLLs through a copied WpcMon.exe.
Huntress says attackers entered business networks through camera management software in incidents traced to September and October. Analysts could not identify the application or how it was compromised; strings in CMS.exe may indicate a Korean camera vendor, which Huntress calls unconfirmed. Intruders dropped the reverse shell rs.win32.exe, sideloaded two DLLs with a relocated WpcMon.exe, set a Run key, and connected to 144.172.116.37.
Unconfirmed: Huntress has not confirmed the software vendor or how the application was compromised.
- rs.win32.exe was dropped in AppData\Roaming\CMS\RemoteSetup and launched by CMS.exe.
- IPHLPAPI.DLL and samcli.dll were disguised as zlib libraries and sideloaded.
- A user Run key pointed to WpcMon.exe under AppData\Local\Microsoft\WpcMon.
- Observed command-and-control traffic went to 144.172.116.37.
Impact: Initial access and a reverse shell on business endpoints
| Product | Affected |
|---|---|
| camera management software (CMS.exe) | — |
- 1.Hunt for CMS.exe launching rs.win32.exe and WpcMon.exe outside the Windows system folder.
- 2.Alert on outbound connections to 144.172.116.37.
- 3.Block unapproved executables and DLLs from running in user-writable paths.
- Products
- CMS.exeWpcMon.exe
- Malware
- rs.win32.exe
- Organizations
- Huntress
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 144.172.116.37 | n Outbound connections to the command-and-control server at 144.172.116[.]37 “Security teams often focus on the software they know att |
From the original article
2 min read at helpnetsecurity.com
Attackers have been breaking into business networks through camera management software, according to new research from security firm Huntress, which traced several incidents in September and October back to a compromised application.
By Zeljka Zorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.