Skip to content
NewA calmer, faster ZeroHour
StoryMalwarehigh

Huntress ties camera software cases to reverse shell and DLL sideloading

4 sources · 4 articlesFirst reported Updated ()3
What's new

October 28: Help Net Security says CMS.exe strings may indicate an unconfirmed Korean camera vendor and specifies a user Run key under AppData\Local\Microsoft\WpcMon.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Huntress says September and October cases used CMS.exe to deploy a reverse shell, sideload DLLs, and beacon to one host.

Huntress reported a handful of customer incidents in September and October 2026 that began with compromised camera management software, CMS.exe, under Program Files (x86)\CMS. Attackers staged rs.win32.exe under AppData\Roaming\CMS\RemoteSetup and launched what Huntress assessed as a reverse shell toward a remote host on port 8000. They copied legitimate Microsoft WpcMon.exe into AppData, sideloaded modified samcli.dll and IPHLPAPI.DLL, set a user Run key for sign-in persistence, and beaconed to 144.172.116.37. Huntress could not name the vendor or initial-access method. A kvision.ai package, a 3R Global string, and a possible Korean camera vendor are unconfirmed leads; the evidence does not show a confirmed vendor supply-chain breach or a CVE.

Key facts
  • Incidents affected several Huntress customers in September and October 2026.
  • CMS.exe was under C:\Program Files (x86)\CMS and lacked file version information.
  • rs.win32.exe ran from AppData\Roaming\CMS\RemoteSetup toward port 8000.
  • Malicious IPHLPAPI.DLL and samcli.dll were modified zlib libraries sideloaded by WpcMon.exe.
  • Every case contacted command host 144.172.116.37; no CVE was identified.
  • Vendor, download source, and initial access remain unconfirmed.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 27, 2026Huntress publishes camera-software intrusion findings · Huntress

What each outlet adds

beyond the shared facts
  • HuntressCites 3r-dataware.com string and unconfirmed kvision.ai package.
  • GBHackersSays Huntress published SHA256 values for the shell and DLLs.
  • Cyber Security NewsStates evidence does not confirm a vendor supply-chain breach or CVE.
  • Help Net SecurityAdds possible Korean vendor and the AppData WpcMon Run key path.
Vendors
Microsoft
Products
Windows Parental Control MonitorCMS.exeWpcMon.exe
Malware
samcli.dllIPHLPAPI.DLLrs.win32.exe
Organizations
Huntress

Coverage

oldest first · one row per article · UTC
  1. · 3d ago HuntressFirst report

    Compromised camera software used to deploy malware, Huntress says

    In September and October cases, attackers dropped rs.win32.exe, sideloaded DLLs with WpcMon.exe, and beaconed to a C2 host.

  2. · 2d ago GBHackers

    Camera software intrusions drop reverse shells and sideloaded DLLs

    Huntress tied September and October cases to one C2 after CMS.exe launched a user-writable reverse shell and relocated WpcMon.exe.

  3. · 2d ago Cyber Security News

    Camera software used to sideload malware on Windows

    Huntress saw a suspected reverse shell and one shared command server across several customers, with no CVE identified.

  4. · 2d ago Help Net Security

    Huntress: compromised camera software used to enter corporate networks

    September and October cases show CMS.exe launching a reverse shell and sideloading DLLs through a copied WpcMon.exe.