Compromised camera management software gives attackers a way into corporate networks

Huntress observed multiple intrusions that they attribute to a compromised camera management application (CMS.exe). Attackers dropped a reverse shell (rs.win32.exe) into AppData, copied a legitimate-sounding WpcMon.exe into a user folder and used it to sideload malicious DLLs (IPHLPAPI.DLL, samcli.dll), persisted via a Run registry value, and made outbound connections to C2 144.172.116.37. The vendor and initial compromise remain unconfirmed; Huntress provided IOCs and recommended inventorying camera systems, restricting access, monitoring for the CMS.exe → rs.win32.exe → abnormal WpcMon.exe sequence, and using application control to block unapproved binaries and DLLs in user-writable paths.