Attackers exploited a camera management software flaw to deploy malicious files, abuse a legitimate Windows program, and maintain remote access across multiple customer environments, as reported by Huntress. The company observed these incidents during September and October, and investigators noted that the camera management software, identified as CMS.exe, served as the initial entry point in each case.
After gaining access, attackers employed a consistent sequence: dropping a remote access executable, loading malicious DLLs via a trusted Windows binary, and communicating with a shared command-and-control server. Huntress could not determine the exact product name or vendor due to the executable's lack of embedded File Version Information. Investigators discovered several significant strings within the binary, including developerslavery, an encoded version, and hxxp://cloudapi.3r-dataware[.
]com/sso/.
The command line specified a remote IP address, port 8000, file arguments, an administrator username, and a password value. The files, IPHLPAPI.DLL and samcli.dll, appeared to have legitimate zlib compression capabilities but were actually modified to include beaconing capabilities. The observed process chain connected CMS.exe, rs.win32.exe, and the unusually located WpcMon.exe, providing defenders with a useful investigation pattern.
Organizations should inventory camera management applications, restrict unnecessary access, and monitor unexpected child processes and outbound connections.
Indicators of Compromise Indicator type Indicator Description SHA256 1fb4af4862643dcab1459872f723f574f1a588855b020916b600df5c20681144 Hash of rs.win32.exe, the dropped executable assessed as a reverse shell. Explore for your team.
