Camera software used to sideload malware on Windows
Original title: Hackers Compromise Camera Management Software to Deploy Malware on Windows Computers
Huntress saw a suspected reverse shell and one shared command server across several customers, with no CVE identified.
Huntress reported a handful of incidents in September and October 2026 in which attackers used camera management software to drop a suspected reverse shell and load malicious DLLs through a genuine Microsoft Windows Parental Control Monitor binary. Persistence was set through the user Run registry key, and every case contacted the same command-and-control address. Researchers could not name the camera product or the initial compromise method and said the evidence does not show a confirmed vendor supply-chain breach.
Unconfirmed: How the camera software was first compromised, and which vendor supplied it, remains unresolved.
- The reverse shell was staged under AppData\Roaming\CMS\RemoteSetup\.
- Malicious samcli.dll and IPHLPAPI.DLL loaded beside relocated WpcMon.exe.
- Shared command address was 144.172.116.37, with port 8000 observed.
- Strings referenced 3R Global, but Huntress did not confirm the vendor.
- Initial application path cited was C:\Program Files (x86)\CMS\CMS.exe.
Impact: Persistent code execution through a reverse shell
| Product | Affected |
|---|---|
| CMS camera management software | — |
- 1.Investigate CMS.exe launching unexpected executables and WpcMon.exe from AppData.
- 2.Block unapproved executables and DLLs in user-writable directories where practical.
- 3.Hunt for the published hashes and command address 144.172.116.37.
- Vendors
- Microsoft
- Malware
- samcli.dllIPHLPAPI.DLL
- Organizations
- Huntress
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | 3r-dataware.com | ware identification clues only Embedded URL hxxp://cloudapi.3r-dataware[.]com/sso/ Software provenance clue; not confirmed C2 Related d |
| domain | kvision.ai | clue; not confirmed C2 Related domains 3r-dataware[.]com ; kvision[.]ai Investigative context, not confirmed malicious Note: IP a |
| ipv4 | 144.172.116.37 | 424b42b7373f10b4c8d74c87a Malicious IPHLPAPI.DLL C2 address 144.172.116[.]37 Shared across observed incidents Application path C:\Prog |
| sha256 | 1fb4af4862643dcab1459872f723f574f1a588855b020916b600df5c20681144 | cators of compromise (IoCs):- Type Indicator Context SHA256 1fb4af4862643dcab1459872f723f574f1a588855b020916b600df5c20681144 rs.win32.exe ; suspected reverse shell SHA256 8f8e88c54a9c5 |
| sha256 | 70b2345302264c41504d59e6a63d6d908969740424b42b7373f10b4c8d74c87a | 79536642fcca1902acdc3d4b1fd1035 Malicious samcli.dll SHA256 70b2345302264c41504d59e6a63d6d908969740424b42b7373f10b4c8d74c87a Malicious IPHLPAPI.DLL C2 address 144.172.116[.]37 Shared a |
| sha256 | 8f8e88c54a9c56174974711eff99b4beb79536642fcca1902acdc3d4b1fd1035 | 0df5c20681144 rs.win32.exe ; suspected reverse shell SHA256 8f8e88c54a9c56174974711eff99b4beb79536642fcca1902acdc3d4b1fd1035 Malicious samcli.dll SHA256 70b2345302264c41504d59e6a63d6d9 |
| url | http://cloudapi.3r-dataware.com/sso/ | 9a1v4e3r4y6 Software identification clues only Embedded URL hxxp://cloudapi.3r-dataware[.]com/sso/ Software provenance clue; not confirmed C2 Related domain |
From the original article
4 min read at cybersecuritynews.com
Hackers have compromised camera management software to deploy malware on Windows computers, using a legitimate Microsoft program to run malicious code and maintain access. The activity shows how software used to manage surveillance systems can become an entry point into business networks. The incidents followed a similar pattern: attackers gained access through the camera application, […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.