Huntress Says Attackers Are Getting In Through Camera Management Software, Then Sideloading Beacons Through a Copied Copy of Windows' WpcMon.exe

LONDON - Huntress says a handful of customer incidents in September and October started inside camera management software and then moved into a familiar living-off-the-land pattern: a reverse shell, DLL sideloading through a copied Windows binary, a Run-key foothold and a beacon to a single command-and-control address.

Across the cases, the first process Huntress could see was C:\Program Files (x86)\CMS\CMS.exe. Analysts could not recover a vendor name from the file's version information, but the binary contained the strings developerslavery, a digit-scrambled form of the same word, and the URL hxxp://cloudapi.3r-dataware[.]com/sso/. The domain 3r-dataware[.]com resolves to a Korean company called 3R Global. A CMS package listed on kvision[.]ai's software download page carries the same strings, though Huntress says it cannot prove the customer installs came from that site.

From CMS.exe to a reverse shell

Once the camera platform was under the attacker's control, a file named rs.win32.exe appeared under the user-writable path C:\Users\<user>\AppData\Roaming\CMS\RemoteSetup\, not under the protected Program Files tree. It was launched with a command line that supplied a remote IP, port 8000, the -c and -r flags, and the credentials admin / 1234567a7654321. Huntress reads that as a reverse-shell remote-control session.

WpcMon.exe outside System32

Next, the actor dropped the legitimate Microsoft Windows Parental Control Monitor, WpcMon.exe, into C:\Users\<user>\AppData\Local\Microsoft\WpcMon\. The SHA256 matched the real Microsoft binary, but the folder is not where that file normally lives (System32). Beside it sat two DLLs, IPHLPAPI.DLL and samcli.dll, that looked like zlib compression libraries but had been modified to beacon. WpcMon.exe was then used to sideload those DLLs.

Persistence was a value under the user's Run key that pointed at the AppData copy of WpcMon.exe. In every incident Huntress reviewed, the C2 address on the impacted endpoints was 144.172.116[.]37.

Huntress could not recover application logs that would show how the camera software itself was first compromised, so the report stops short of naming an exploit or a stolen credential. What the SOC can see is the post-compromise chain that follows.

What to hunt

The detection surface is concrete. Hunt for CMS.exe spawning rs.win32.exe from AppData\Roaming\CMS\RemoteSetup; for WpcMon.exe executing from any path other than System32, especially under AppData\Local\Microsoft\WpcMon; for IPHLPAPI.DLL or samcli.dll loaded beside that binary; for a user Run key named WpcMon; and for established TCP connections from those processes to 144.172.116.37 on port 443.

Hashes published in the report: rs.win32.exe SHA256 1fb4af4862643dcab1459872f723f574f1a588855b020916b600df5c20681144; samcli.dll SHA256 8f8e88c54a9c56174974711eff99b4beb79536642fcca1902acdc3d4b1fd1035; IPHLPAPI.DLL SHA256 70b2345302264c41504d59e6a63d6d908969740424b42b7373f10b4c8d74c87a. Huntress also recommends inventorying camera management platforms, restricting their access, and using application control to block unapproved executables and DLLs in user-writable paths.