{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/cms-camera-management-software/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["CMS (Camera Management Software)"],"_cs_severities":["high"],"_cs_tags":["initial-access","persistence","c2","defense-evasion","malware"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eHuntress identified a campaign involving the compromise of camera management software (CMS.exe) to facilitate unauthorized access to enterprise environments. Following initial access, the attackers deployed a malicious binary (rs.win32.exe), performed DLL sideloading using the legitimate Windows Parental Controls Monitor (WpcMon.exe), established persistence via registry Run keys, and beaconed to a C2 server.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eInitial access via exploitation of camera management software (CMS.exe).\u003c/li\u003e\n\u003cli\u003eDeployment of malicious binary 'rs.win32.exe' to the endpoint.\u003c/li\u003e\n\u003cli\u003eExecution of 'WpcMon.exe' to perform DLL sideloading in the user's AppData directory.\u003c/li\u003e\n\u003cli\u003eEstablishment of persistence through Windows registry Run keys.\u003c/li\u003e\n\u003cli\u003eEstablishment of outbound C2 communication to '144.172.116.37'.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory and restrict access to camera management software; treat these applications as part of the enterprise attack surface.\u003c/li\u003e\n\u003cli\u003eImplement monitoring for unauthorized process executions originating from 'CMS.exe'.\u003c/li\u003e\n\u003cli\u003eRestrict execution of binaries and DLLs from user-writable paths such as '%AppData%'.\u003c/li\u003e\n\u003cli\u003eMonitor for registry modifications targeting 'HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run' or 'HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\u003c/li\u003e\n\u003cli\u003eBlock the identified C2 IP address '144.172.116.37' at the network perimeter.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-28T11:38:20Z","date_published":"2026-10-28T11:38:20Z","id":"https://feed.craftedsignal.io/briefs/2026-10-camera-management-software-compromise/","summary":"Attackers are exploiting camera management software to gain initial access and deploy malware via DLL sideloading using the legitimate Windows process WpcMon.exe.","title":"Camera Management Software Compromised for Malware Deployment","url":"https://feed.craftedsignal.io/briefs/2026-10-camera-management-software-compromise/"}],"language":"en","title":"CraftedSignal Threat Feed - CMS (Camera Management Software)","version":"https://jsonfeed.org/version/1.1"}