Compromised camera management software opens way into corporate networks

Huntress linked several September and October incidents to a compromised camera management application, CMS.exe. Attackers drop a reverse shell rs.win32.exe, sideload malicious DLLs via a fake WpcMon.exe and connect to C2 server 144.172.116.37.

• Malicious rs.win32.exe launched from AppData\Roaming\CMS\RemoteSetup
• WpcMon.exe copy placed outside the Windows system folder and set to autostart
• IPHLPAPI.DLL and samcli.dll disguised as zlib libraries
• Vendor unconfirmed; strings point to a Korean camera maker