# Wpcdoor Backdoor Distributed via Korea-Based CMS DVR Management Software (Larva-26013)

> AhnLab ASEC analyzed attacks in which a Korean company's CMS DVR/camera management software was abused to deliver the Wpcdoor backdoor through DLL side-loading downloaders. ASEC attributes the activity to Larva-26013; the link between the attack and the software vendor could not be determined.

- **Published:** 2026-11-11T04:13:47Z
- **Last reviewed:** 2026-11-11T04:13:47Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5724
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5724.png
- **ID:** TL-2026-5724
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Larva-26013
- **Detections:** 9 (1 shown free below) · **IOCs:** 39 (3 shown free below)

## Description

In September-October 2026, Huntress traced several intrusions to a compromised camera management application, CMS.exe (Central Management Software), and published its findings on 2026-10-27. Huntress could not determine how CMS.exe was compromised because no application logs were available. The binary has no version information, and embedded strings (3r-dataware[.]com, an SSO URL on cloudapi.3r-dataware[.]com) point to a possible Korean camera/DVR vendor. Huntress presents that link as unconfirmed.

AhnLab ASEC (2026-11-06) analyzed the malware family, which it names Wpcdoor. CMS installs files under %APPDATA%\CMS\RemoteSetup\, possibly during an update or when a feature is enabled. rs.win32.exe then runs and side-loads a malicious IPHLPAPI.DLL, which exports GetAdaptersInfo() and forwards calls to the legitimate DLL in the same folder. This stage-1 downloader requests WpcMon.exe and samcli.dll from the C2. Both are saved to %LOCALAPPDATA%\Microsoft\WpcMon\. WpcMon.exe is a legitimate Microsoft Windows Parental Control Monitor binary and side-loads samcli.dll, the stage-2 downloader. Stage 2 downloads Wpcdoor and runs it in memory. A Run key value named WpcMon provides persistence, and the stage-2 mutex is Global\81669d8b1539333e96b84c2e5c4dba5d. An alternate chain uses QtCore4.dll as the first-stage downloader. It fetches rsaenh.dll to %LOCALAPPDATA%\Microsoft\Windows\System32\, repoints the WINDIR and SystemRoot environment variables to %LOCALAPPDATA%\Microsoft\Windows\, and runs C:\Windows\Sysnative\FileHistory.exe.

The C2 protocol uses packets that begin with the signature 'WPCF'. They carry a version field, size fields, a checksum, random data, and an encrypted payload with the requested filename at the end. Payloads are decrypted with the XOR key 0x82615458, and both downloader stages share the same packet format and key. Wpcdoor first reports the UUID, username, computer name, OS version and a screenshot, and checks whether zlib.dll is present in its folder. It then awaits operator commands: screenshot (0x01), clipboard hijacking (0x02) and modification (0x03), file download/upload (0x06), command execution (0x07), file lookup (0x08), file grabber for Desktop, Downloads, Documents, Pictures, Videos, OneDrive and AppData (0x09), port forwarding (0x0B/0x0C), browser data theft covering credentials, cookies, history and card numbers (0x0D), process memory dump and theft (0x0E), search of wallet-extension process memory for seed-phrase-like strings (0x0F), process termination (0x11), self-update (0x12) and HVNC (0x13, 172.86.127[.]14:8443). The 0x0F command targets MetaMask (Chrome and Edge), Coinbase, Phantom, Trust, Ronin, Binance, TronLink, Solflare and SecondFi extensions. The malware also sends periodic screenshots, keylogging data, clipboard text matching set conditions, and heartbeats.

ASEC tracks the actor as Larva-26013, which has also installed Wpcdoor in attacks outside Korea. No CVE, CVSS or affected-version information is stated in the sources. Whether a vulnerability, misconfiguration or built-in feature was involved is unknown, so severity is analyst-assigned. Huntress also observed rs.win32.exe launched with arguments (-i <IP> -p 8000 ... admin <password>) and assessed it as a reverse shell. That assessment is an inference from the command line and not a confirmed binary analysis.

## MITRE ATT&CK

- T1059 Command and Scripting Interpreter
- T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
- T1574.001 DLL
- T1036.005 Masquerading: Match Legitimate Resource Name or Location
- T1620 Reflective Code Loading
- T1555.003 Credentials from Password Stores: Credentials from Web Browsers
- T1056.001 Input Capture: Keylogging
- T1082 System Information Discovery
- T1033 System Owner/User Discovery
- T1021.005 Remote Services: VNC
- T1539 Steal Web Session Cookie
- T1003 OS Credential Dumping
- T1113 Screen Capture
- T1005 Data from Local System
- T1119 Automated Collection
- T1573.001 Encrypted Channel: Symmetric Cryptography
- T1090 Proxy

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Wpcdoor Stage 0 - CMS.exe Launching rs.win32.exe Side-Loading Host (Exploitation)** (`TL-2026-5724-SPL-001`)

Detects the Wpcdoor (Larva-26013) initial execution chain: the Korea-based CMS DVR management software (CMS.exe) launching rs.win32.exe from %APPDATA%\CMS\RemoteSetup\, or rs.win32.exe run with the observed -i/-p 8000 reverse-shell style arguments. rs.win32.exe side-loads the malicious IPHLPAPI.DLL, the stage-1 downloader that fetches WpcMon.exe and samcli.dll from the C2. Behaviour-first: it does not depend on hashes or IPs.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1574.002, T1036.005, T1059
- **Data sources:** sysmon, microsoft_defender_for_endpoint
- **Severity:** high
- **Confidence:** high

### Splunk SPL

````spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
```Wpcdoor stage 0: CMS.exe drops and launches rs.win32.exe (TL-2026-5724, Larva-26013)```
| eval img=lower(Image), par=lower(ParentImage), cmd=lower(CommandLine)
| eval chain_cms_rs=if(match(par,"\\\\cms\\.exe$") AND match(img,"\\\\cms\\\\remotesetup\\\\rs\\.win32\\.exe$"),1,0)
| eval rs_args=if(match(img,"\\\\rs\\.win32\\.exe$") AND match(cmd,"\\s-i\\s") AND match(cmd,"\\s-p\\s+.?8000"),1,0)
| where chain_cms_rs=1 OR rs_args=1
| eval signal=case(chain_cms_rs=1 AND rs_args=1,"cms_chain+revshell_args",chain_cms_rs=1,"cms_to_rs.win32.exe",true(),"rs.win32.exe_port_8000_args")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(signal) as signals by Computer, User, ParentImage, Image
| convert ctime(first_seen) ctime(last_seen)
````

### Microsoft KQL

```kql
// Wpcdoor stage 0 - CMS.exe launching rs.win32.exe (TL-2026-5724)
DeviceProcessEvents
| where Timestamp > ago(24h)
| where (InitiatingProcessFileName =~ "CMS.exe" and FileName =~ "rs.win32.exe" and FolderPath has @"\CMS\RemoteSetup\")
    or (FileName =~ "rs.win32.exe" and ProcessCommandLine matches regex @"\s-i\s+\S+.*\s-p\s+\W?8000")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessFolderPath, FileName, FolderPath, ProcessCommandLine, SHA256
| order by Timestamp desc
```

### Sigma

```yaml
title: Wpcdoor CMS.exe Spawning rs.win32.exe Side-Loading Host
id: 6f1c2b7e-3a54-4d0e-9b61-0c7d8e5a1f21
status: experimental
description: Detects CMS.exe launching rs.win32.exe from the CMS RemoteSetup folder, or rs.win32.exe run with -i/-p 8000 arguments, the stage-0 chain of the Wpcdoor backdoor (Larva-26013).
references:
    - https://asec.ahnlab.com/en/96477/
    - https://www.huntress.com/blog/camera-management-software-compromise-malware
author: Threadlinqs Team
date: 2026/11/11
tags:
    - attack.defense-evasion
    - attack.t1574.002
    - attack.t1036.005
    - attack.execution
    - attack.t1059
logsource:
    category: process_creation
    product: windows
detection:
    selection_chain:
        ParentImage|endswith: '\CMS.exe'
        Image|endswith: '\CMS\RemoteSetup\rs.win32.exe'
    selection_args:
        Image|endswith: '\rs.win32.exe'
        CommandLine|contains|all:
            - ' -i '
            - ' -p '
            - '8000'
    condition: 1 of selection_*
falsepositives:
    - Sanctioned CMS DVR software that legitimately runs a RemoteSetup helper
level: high

```

**Known false positives:**

- Legitimate CMS (Central Management Software) updates or remote-setup features that run a helper from %APPDATA%\CMS\RemoteSetup\ in environments where the product is sanctioned
- Administrators intentionally running a tool named rs.win32.exe with -i/-p arguments

**Tuning notes:** Verify the index name (index=sysmon) matches your Sysmon index. If CMS is a sanctioned product, baseline the signed CMS version and alert on an rs.win32.exe hash that does not match the vendor-supplied one; keep the argument-pattern branch (-p 8000) enabled regardless. Extend the time window for retro-hunting back to 2026-09-01 (first Huntress incidents).

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Wpcdoor Side-Loaded Downloader DLLs (IPHLPAPI/samcli/QtCore4/rsaenh) Loaded from User-Writable Paths (Exploitation) (locked: unlock with TL Creds)
- Wpcdoor QtCore4 Variant - Fake Windows System32 Tree and WINDIR/SystemRoot Repointing (Post-Exploitation) (locked: unlock with TL Creds)
- Wpcdoor Implant Processes Making Network Connections ([indicator] / [indicator] / Fake System32 Hosts) (C2 / Lateral Movement) (locked: unlock with TL Creds)
- Wpcdoor Masquerading - [indicator] / FileHistory.exe Executing Outside System Directories (Exploitation) (locked: unlock with TL Creds)
- Wpcdoor Browser / Crypto-Wallet Extension Process Memory Access by Implant (Post-Exploitation) (locked: unlock with TL Creds)
- Wpcdoor Stage Download - [indicator] / [indicator] Written to WpcMon Folder by Downloader (C2 / Lateral Movement) (locked: unlock with TL Creds)
- Wpcdoor Persistence - WpcMon Run Key Value Pointing to User-Writable WpcMon Folder (Post-Exploitation) (locked: unlock with TL Creds)
- Wpcdoor C2 and HVNC Infrastructure Connections ([indicator], [indicator]:8443, [indicator]) (C2 / Lateral Movement) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 39)

Defanged, TLP:CLEAR.

- IP address: `144.172.116[.]37`
- Domain: `3r-dataware[.]com`
- File hash: `0a9cb414b53536ad8fc217fc46a2cf56`

Full set of 39 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Analysis of Wpcdoor Attack Cases Spread via Korea-Based DVR Management Software](https://asec.ahnlab.com/en/96477/)
- [Who Watches the Watchers?](https://www.huntress.com/blog/camera-management-software-compromise-malware)
- [Compromised camera management software gives attackers a way into corporate networks](https://helpnetsecurity.com/2026/10/28/compromised-camera-management-software-initial-access)
- [Hackers are breaking into company networks via hacked CCTV camera software](https://techradar.com/pro/security/hackers-are-breaking-into-company-networks-via-hacked-cctv-camera-software)
- [Cyber Security News: camera software hijacking](https://gbhackers.com/camera-software-hijacking/amp/)
- [MITRE ATT&CK T1574.002 DLL Side-Loading](https://attack.mitre.org/techniques/T1574/002/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5724