Published on October 28, 2026
Hackers Hijack Camera Management Software to Deploy Reverse Shells and Hidden Windows Malware
Severity
Medium
Detail
Huntress researchers have disclosed an analysis detailing a series of intrusions during September and October where attackers compromised CMS.exe, a video camera management application installed in non-standard enterprise locations. By exploiting vulnerable or exposed camera software, threat actors deployed reverse shell components, performed DLL sideloading via a legitimate Windows utility, and established persistence within corporate environments.
While the exact initial compromise vector remains unconfirmed due to missing application logs, investigators traced distinctive code strings within CMS.exe to packages linked to 3R Global and kvision[.]ai, underscoring the risk of overlooked third-party surveillance software becoming gateways into broader corporate networks.
How?
The post-compromise attack sequence relies on abusing user-writable directories, process hijacking, and registry modification to execute malicious payloads and maintain network access:
The intrusion chain begins when attackers compromise the camera management application and drop a reverse shell binary, rs.win32.exe, into C:\Users\<user>\AppData\Roaming\CMS\RemoteSetup\. When executed, the binary passes arguments specifying a remote IP address, port 8000, configuration parameters, and default credentials (admin) to establish an outbound reverse shell session.
To conceal ongoing execution, attackers deploy a DLL sideloading chain using a legitimate, digitally signed Microsoft binary, WpcMon.exe (Windows Parental Control Monitor). Rather than running from its native C:\Windows\System32\ directory, WpcMon.exe is placed into C:\Users\<user>\AppData\Local\Microsoft\WpcMon\. Upon execution, the clean utility automatically loads rogue DLL files (IPHLPAPI.DLL and samcli.dll) from its local directory.
While masquerading as standard zlib compression libraries, these malicious DLLs execute beaconing functionality to a shared command-and-control (C2) address (144.172.116[.]37).
For persistence, the threat actors add the relocated WpcMon.exe executable to the compromised user’s Windows Run registry key. This ensures that the sideloading chain and C2 beaconing execute automatically whenever the user logs into the system.
Conclusion
This campaign highlights how peripheral, unmonitored software like camera management systems can be turned into persistence hubs for enterprise breaches. Because the attackers rely on legitimate Windows binaries to execute malicious code, standard signature checks on running processes are insufficient for detection.
To mitigate this threat, organizations should conduct thorough software inventories to identify and restrict camera management applications across corporate endpoints. Security teams must implement Application Control or AppLocker policies to prevent executable and DLL execution within user-writable directories (such as AppData).
Finally, defenders should monitor endpoints for anomalous process executions of WpcMon.exe outside of System32, audit Run registry keys for suspicious startup paths, and block network traffic to sanitized C2 indicators like 144.172.116[.]37 and cloudapi.3r-dataware[.]com.
Source