Camera Management Software Compromised for Malware Deployment

Huntress identified a campaign involving the compromise of camera management software (CMS.exe) to facilitate unauthorized access to enterprise environments. Following initial access, the attackers deployed a malicious binary (rs.win32.exe), performed DLL sideloading using the legitimate Windows Parental Controls Monitor (WpcMon.exe), established persistence via registry Run keys, and beaconed to a C2 server.

Attack Chain

1. Initial access via exploitation of camera management software (CMS.exe).
2. Deployment of malicious binary 'rs.win32.exe' to the endpoint.
3. Execution of 'WpcMon.exe' to perform DLL sideloading in the user's AppData directory.
4. Establishment of persistence through Windows registry Run keys.
5. Establishment of outbound C2 communication to '144.172.116.37'.

Recommendation

• Inventory and restrict access to camera management software; treat these applications as part of the enterprise attack surface.
• Implement monitoring for unauthorized process executions originating from 'CMS.exe'.
• Restrict execution of binaries and DLLs from user-writable paths such as '%AppData%'.
• Monitor for registry modifications targeting 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run' or 'HKLM\Software\Microsoft\Windows\CurrentVersion\Run'.
• Block the identified C2 IP address '144.172.116.37' at the network perimeter.