Hackers Hijack Camera Management Software to Deploy Reverse Shells and Hidden Windows Malware

Attackers are compromising camera management software to gain remote access, run malicious DLLs through a legitimate Windows component, and maintain persistent footholds in enterprise environments.

The incidents show how overlooked surveillance applications can become entry points into broader corporate networks.

Huntress observed several intrusions during September and October involving CMS.exe, a camera management application installed under C:\Program Files (x86)\CMS\.

Investigators could not conclusively identify the software’s vendor because CMS.exe lacked embedded File Version Information.

The executable contained distinctive strings, including developerslavery, an obfuscated variation of that string, and a reference to cloudapi.3r-dataware[.]com/sso/.

Huntress found matching strings and the same domain reference in a CMS package available through kvision[.]ai.

Although domain registration information pointed toward Korean company 3R Global, researchers explicitly cautioned that these similarities did not establish a definitive vendor relationship or prove victims downloaded their software from that website.

Following compromise, attackers dropped rs.win32.exe into C:\Users\<user>\AppData\Roaming\CMS\RemoteSetup\.

Its execution arguments specified a remote IP address, port 8000, configuration parameters, and authentication values including the username admin.

Huntress interpreted this combination of remote connectivity and execution from a user-writable directory as reverse-shell activity.

Huntress Researchers observed that, attackers compromised the application before deploying additional payloads. However, missing application logs and limited executable metadata prevented them from establishing exactly how the initial compromise occurred.

The supplied authentication values describe the observed execution command; they do not establish how attackers originally accessed the camera management application.

Camera Software Hijacking

That distinction matters because the investigation documented subsequent malicious activity more clearly than the initial intrusion mechanism itself.

The next stage centered on DLL sideloading. Attackers placed a legitimate copy of Microsoft’s Windows Parental Control Monitor, WpcMon.exe, inside C:\Users\<user>\AppData\Local\Microsoft\WpcMon\, rather than its expected C:\Windows\System32 location. Huntress verified the executable’s legitimacy using its SHA256 hash.

The genuine executable then served as a vehicle for loading attacker-controlled IPHLPAPI.DLL and samcli.dll files. Both appeared to be zlib compression libraries but had been modified to incorporate beaconing functionality.

Across the investigated incidents, compromised endpoints contacted the same command-and-control address, 144.172.116[.]37.

This technique exploits which DLL a trusted application loads, allowing malicious functionality to execute behind a legitimate process.

MITRE ATT&CK documents this behavior under its DLL execution hijacking guidance, explaining why executable legitimacy alone cannot establish that a running process is benign.

Attackers also added the relocated WpcMon.exe to a value beneath the affected user’s Run registry key.

This ensured execution whenever that user signed in, matching MITRE’s Registry Run Keys / Startup Folder persistence technique. Huntress observed the associated process sequence linking CMS.exe, rs.win32.exe, and WpcMon.exe.

Organizations should inventory camera management applications, restrict their accessibility, and monitor their execution and outbound traffic.

Where practical, application controls should prevent unapproved executables and DLLs from running in user-writable directories.

The observed process chain, unexpected WpcMon.exe location, Run key modifications, and connections to the reported C2 provide concrete investigation pivots.

Huntress’s original investigation also publishes SHA256 indicators for rs.win32.exe and both malicious DLLs, supporting retrospective endpoint searches and incident triage.

The report acknowledges John Hammond, Ethan Williams, and Dray Agha for their contributions to the investigation and writeup.

Indicators of Compromise

Indicator	Description
Rs.win32.exeSHA256:1fb4af4862643dcab1459872f723f574f1a588855b020916b600df5c20681144	File dropped in users’ AppData folder path
samcli.dllSHA256:8f8e88c54a9c56174974711eff99b4beb79536642fcca1902acdc3d4b1fd1035	Malicious DLL
IPHLPAPI.DLLSHA256:70b2345302264c41504d59e6a63d6d908969740424b42b7373f10b4c8d74c87a	Malicious DLL

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.