Wpcdoor Backdoor Distributed via Korea-Based CMS DVR Management Software (Larva-26013)

Key facts

Detection coverage

As of 2026-11-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5724 across Splunk SPL, Microsoft KQL and Sigma, covering 39 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Wpcdoor Stage 0 - CMS.exe Launching rs.win32.exe Side-Loading Host (Exploitation)

Detects the Wpcdoor (Larva-26013) initial execution chain: the Korea-based CMS DVR management software (CMS.exe) launching rs.win32.exe from %APPDATA%\CMS\RemoteSetup\, or rs.win32.exe run with the observed -i/-p 8000 reverse-shell style arguments. rs.win32.exe side-loads the malicious IPHLPAPI.DLL, the stage-1 downloader that fetches WpcMon.exe and samcli.dll from the C2. Behaviour-first: it does not depend on hashes or IPs.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1574.002, T1036.005, T1059
• Data sources: sysmon, microsoft_defender_for_endpoint
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
```Wpcdoor stage 0: CMS.exe drops and launches rs.win32.exe (TL-2026-5724, Larva-26013)```
| eval img=lower(Image), par=lower(ParentImage), cmd=lower(CommandLine)
| eval chain_cms_rs=if(match(par,"\\\\cms\\.exe$") AND match(img,"\\\\cms\\\\remotesetup\\\\rs\\.win32\\.exe$"),1,0)
| eval rs_args=if(match(img,"\\\\rs\\.win32\\.exe$") AND match(cmd,"\\s-i\\s") AND match(cmd,"\\s-p\\s+.?8000"),1,0)
| where chain_cms_rs=1 OR rs_args=1
| eval signal=case(chain_cms_rs=1 AND rs_args=1,"cms_chain+revshell_args",chain_cms_rs=1,"cms_to_rs.win32.exe",true(),"rs.win32.exe_port_8000_args")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(signal) as signals by Computer, User, ParentImage, Image
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

// Wpcdoor stage 0 - CMS.exe launching rs.win32.exe (TL-2026-5724)
DeviceProcessEvents
| where Timestamp > ago(24h)
| where (InitiatingProcessFileName =~ "CMS.exe" and FileName =~ "rs.win32.exe" and FolderPath has @"\CMS\RemoteSetup\")
    or (FileName =~ "rs.win32.exe" and ProcessCommandLine matches regex @"\s-i\s+\S+.*\s-p\s+\W?8000")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessFolderPath, FileName, FolderPath, ProcessCommandLine, SHA256
| order by Timestamp desc

Sigma

title: Wpcdoor CMS.exe Spawning rs.win32.exe Side-Loading Host
id: 6f1c2b7e-3a54-4d0e-9b61-0c7d8e5a1f21
status: experimental
description: Detects CMS.exe launching rs.win32.exe from the CMS RemoteSetup folder, or rs.win32.exe run with -i/-p 8000 arguments, the stage-0 chain of the Wpcdoor backdoor (Larva-26013).
references:
    - https://asec.ahnlab.com/en/96477/
    - https://www.huntress.com/blog/camera-management-software-compromise-malware
author: Threadlinqs Team
date: 2026/11/11
tags:
    - attack.defense-evasion
    - attack.t1574.002
    - attack.t1036.005
    - attack.execution
    - attack.t1059
logsource:
    category: process_creation
    product: windows
detection:
    selection_chain:
        ParentImage|endswith: '\CMS.exe'
        Image|endswith: '\CMS\RemoteSetup\rs.win32.exe'
    selection_args:
        Image|endswith: '\rs.win32.exe'
        CommandLine|contains|all:
            - ' -i '
            - ' -p '
            - '8000'
    condition: 1 of selection_*
falsepositives:
    - Sanctioned CMS DVR software that legitimately runs a RemoteSetup helper
level: high

Known false positives:

• Legitimate CMS (Central Management Software) updates or remote-setup features that run a helper from %APPDATA%\CMS\RemoteSetup\ in environments where the product is sanctioned
• Administrators intentionally running a tool named rs.win32.exe with -i/-p arguments

Tuning notes: Verify the index name (index=sysmon) matches your Sysmon index. If CMS is a sanctioned product, baseline the signed CMS version and alert on an rs.win32.exe hash that does not match the vendor-supplied one; keep the argument-pattern branch (-p 8000) enabled regardless. Extend the time window for retro-hunting back to 2026-09-01 (first Huntress incidents).

• 🔒 Wpcdoor Side-Loaded Downloader DLLs (IPHLPAPI/samcli/QtCore4/rsaenh) Loaded from User-Writable Paths (Exploitation) · unlock with TL Creds
• 🔒 Wpcdoor QtCore4 Variant - Fake Windows System32 Tree and WINDIR/SystemRoot Repointing (Post-Exploitation) · unlock with TL Creds
• 🔒 Wpcdoor Implant Processes Making Network Connections ([indicator] / [indicator] / Fake System32 Hosts) (C2 / Lateral Movement) · unlock with TL Creds
• 🔒 Wpcdoor Masquerading - [indicator] / FileHistory.exe Executing Outside System Directories (Exploitation) · unlock with TL Creds
• 🔒 Wpcdoor Browser / Crypto-Wallet Extension Process Memory Access by Implant (Post-Exploitation) · unlock with TL Creds
• 🔒 Wpcdoor Stage Download - [indicator] / [indicator] Written to WpcMon Folder by Downloader (C2 / Lateral Movement) · unlock with TL Creds
• 🔒 Wpcdoor Persistence - WpcMon Run Key Value Pointing to User-Writable WpcMon Folder (Post-Exploitation) · unlock with TL Creds
• 🔒 Wpcdoor C2 and HVNC Infrastructure Connections ([indicator], [indicator]:8443, [indicator]) (C2 / Lateral Movement) · unlock with TL Creds

Indicators of compromise

As of 2026-11-11, Threadlinqs Intelligence tracks 39 indicators of compromise for TL-2026-5724.

Sample indicators (3 of 39)

• IP address: 144.172.116[.]37
• Domain: 3r-dataware[.]com
• File hash: 0a9cb414b53536ad8fc217fc46a2cf56

Defanged, TLP:CLEAR. Full set of 39 indicators: unlock with TL Creds.

Technical analysis

In September-October 2026, Huntress traced several intrusions to a compromised camera management application, CMS.exe (Central Management Software), and published its findings on 2026-10-27. Huntress could not determine how CMS.exe was compromised because no application logs were available. The binary has no version information, and embedded strings (3r-dataware[.]com, an SSO URL on cloudapi.3r-dataware[.]com) point to a possible Korean camera/DVR vendor. Huntress presents that link as unconfirmed.

AhnLab ASEC (2026-11-06) analyzed the malware family, which it names Wpcdoor. CMS installs files under %APPDATA%\CMS\RemoteSetup\, possibly during an update or when a feature is enabled. rs.win32.exe then runs and side-loads a malicious IPHLPAPI.DLL, which exports GetAdaptersInfo() and forwards calls to the legitimate DLL in the same folder. This stage-1 downloader requests WpcMon.exe and samcli.dll from the C2. Both are saved to %LOCALAPPDATA%\Microsoft\WpcMon\. WpcMon.exe is a legitimate Microsoft Windows Parental Control Monitor binary and side-loads samcli.dll, the stage-2 downloader. Stage 2 downloads Wpcdoor and runs it in memory. A Run key value named WpcMon provides persistence, and the stage-2 mutex is Global\81669d8b1539333e96b84c2e5c4dba5d. An alternate chain uses QtCore4.dll as the first-stage downloader. It fetches rsaenh.dll to %LOCALAPPDATA%\Microsoft\Windows\System32\, repoints the WINDIR and SystemRoot environment variables to %LOCALAPPDATA%\Microsoft\Windows\, and runs C:\Windows\Sysnative\FileHistory.exe.

The C2 protocol uses packets that begin with the signature 'WPCF'. They carry a version field, size fields, a checksum, random data, and an encrypted payload with the requested filename at the end. Payloads are decrypted with the XOR key 0x82615458, and both downloader stages share the same packet format and key. Wpcdoor first reports the UUID, username, computer name, OS version and a screenshot, and checks whether zlib.dll is present in its folder. It then awaits operator commands: screenshot (0x01), clipboard hijacking (0x02) and modification (0x03), file download/upload (0x06), command execution (0x07), file lookup (0x08), file grabber for Desktop, Downloads, Documents, Pictures, Videos, OneDrive and AppData (0x09), port forwarding (0x0B/0x0C), browser data theft covering credentials, cookies, history and card numbers (0x0D), process memory dump and theft (0x0E), search of wallet-extension process memory for seed-phrase-like strings (0x0F), process termination (0x11), self-update (0x12) and HVNC (0x13, 172.86.127[.]14:8443). The 0x0F command targets MetaMask (Chrome and Edge), Coinbase, Phantom, Trust, Ronin, Binance, TronLink, Solflare and SecondFi extensions. The malware also sends periodic screenshots, keylogging data, clipboard text matching set conditions, and heartbeats.

ASEC tracks the actor as Larva-26013, which has also installed Wpcdoor in attacks outside Korea. No CVE, CVSS or affected-version information is stated in the sources. Whether a vulnerability, misconfiguration or built-in feature was involved is unknown, so severity is analyst-assigned. Huntress also observed rs.win32.exe launched with arguments (-i <IP> -p 8000 ... admin <password>) and assessed it as a reverse shell. That assessment is an inference from the command line and not a confirmed binary analysis.

MITRE ATT&CK techniques by tactic:

Credential Access

T1003 OS Credential Dumping; T1056.001 Input Capture: Keylogging; T1539 Steal Web Session Cookie; T1555.003 Credentials from Password Stores: Credentials from Web Browsers

Collection

T1005 Data from Local System; T1113 Screen Capture; T1119 Automated Collection

Lateral Movement

T1021.005 Remote Services: VNC

Discovery

T1033 System Owner/User Discovery; T1082 System Information Discovery

Defense Evasion

T1036.005 Masquerading: Match Legitimate Resource Name or Location; T1574.001 DLL; T1620 Reflective Code Loading

Execution

T1059 Command and Scripting Interpreter

Command and Control

T1090 Proxy; T1573.001 Encrypted Channel: Symmetric Cryptography

Persistence

T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Remediation

Patches

• No patch or CVE identified in the sources; the vendor link and the initial compromise method are undetermined

Immediate actions

• Block 144.172.116.37, 172.86.127.14 and 172.86.127.89 at the perimeter, including 172.86.127.14:8443 (HVNC)
• Hunt for CMS.exe -> rs.win32.exe -> WpcMon.exe from %LOCALAPPDATA%\Microsoft\WpcMon\ followed by unapproved outbound connections
• Hunt for the IPHLPAPI.DLL, samcli.dll, QtCore4.dll and rsaenh.dll hashes and for the mutex Global\81669d8b1539333e96b84c2e5c4dba5d
• Remove the WpcMon Run key value and the %APPDATA%\CMS\RemoteSetup\ and %LOCALAPPDATA%\Microsoft\WpcMon\ files from affected hosts
• Reset credentials and revoke sessions for browsers on affected hosts. Move crypto-wallet assets whose seed phrases may have been exposed.

Workarounds

• Isolate hosts running CMS software from sensitive network segments until the software is verified
• Consider uninstalling CMS where it is not required

Longer-term hardening

• Inventory camera/DVR management software (CMS) and restrict its network access
• Use application control to block unapproved executables and DLLs in user-writable paths such as AppData
• Monitor for legitimate Microsoft binaries (WpcMon.exe, FileHistory.exe) running from user-writable locations
• Monitor for changes to the WINDIR and SystemRoot environment variables

Affected and fixed versions

• Unconfirmed (possibly a Korean camera/DVR vendor; strings reference 3r-dataware[.]com) — CMS (Central Management Software) DVR management software: CMS.exe, rs.win32.exe

Timeline

• 2026-09-01 Huntress later reports that incidents originating from the compromised CMS.exe camera management software began in September 2026 (month-level precision; the exact day is not stated).
• 2026-10-01 Additional incidents with the same CMS.exe -> locked-ioc-20 -> locked-ioc-25 chain and C2 locked-ioc-15 are observed during October 2026 (month-level precision).
• 2026-10-27 Huntress publishes 'Who Watches the Watchers?', describing the compromised CMS.exe, locked-ioc-20, side-loaded locked-ioc-19/locked-ioc-23 and C2 locked-ioc-15. The vendor link is unconfirmed.
• 2026-10-28 Help Net Security reports the Huntress findings. The initial compromise method, vendor and attribution are not established.
• 2026-10-29 Secondary outlets (TechRadar, GBHackers and others) repeat the Huntress findings that attackers are entering company networks through compromised CCTV/camera management software. They add no new technical evidence.
• 2026-11-06 ASEC notes that the full stage-2 downloader analysis was not possible because the sample was unavailable. It lists five MD5 hashes and three IP addresses as IOCs, with no hash-to-filename mapping.
• 2026-11-06 ASEC reports infection logs from a Korean firm that develops CCTV/DVR products and says the actor also installed Wpcdoor in attacks outside Korea. The initial access method and the vendor link remain undetermined.
• 2026-11-06 AhnLab ASEC publishes its analysis, naming the final backdoor Wpcdoor and attributing the activity to Larva-26013. It documents the WPCF C2 protocol, the XOR key 0x82615458, the locked-ioc-21 variant and the HVNC infrastructure.

Sources cited

• Analysis of Wpcdoor Attack Cases Spread via Korea-Based DVR Management Software asec.ahnlab.com · Research · 2026-11-06
• Who Watches the Watchers? Huntress · Research · 2026-10-27
• MITRE ATT&CK T1574.002 DLL Side-Loading MITRE · Research
• Compromised camera management software gives attackers a way into corporate networks Help Net Security · News · 2026-10-28
• Hackers are breaking into company networks via hacked CCTV camera software techradar.com · News
• Cyber Security News: camera software hijacking gbhackers.com · News

More in malware

• Mirax Android Banking RAT Abuses Accessibility Services for Device Takeover and Bank Fraud in the Middle East, Türkiye and Africa
• RemControl: Android banking trojan MaaS abusing Accessibility Service, AI-assisted phishing overlays (affiliate UNKK)
• Exvicy: ClickFix MaaS Framework Copycat of ErrTraffic Distributing Malware via Compromised WordPress Sites
• Blind Eagle (APT-C-36) Uses Fake Court Notices to Deliver AsyncRAT/DCRat-Lineage RAT Across Latin America
• GhostFrame: New ESXi Post-Exploitation Implant Linked to TAG-218 / Settra Ransomware