CMS (Camera Management Software) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/cms-camera-management-software/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 28 Oct 2026 11:38:20 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgCamera Management Software Compromised for Malware Deploymenthttps://feed.craftedsignal.io/briefs/2026-10-camera-management-software-compromise/Wed, 28 Oct 2026 11:38:20 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-camera-management-software-compromise/Attackers are exploiting camera management software to gain initial access and deploy malware via DLL sideloading using the legitimate Windows process WpcMon.exe.Huntress identified a campaign involving the compromise of camera management software (CMS.exe) to facilitate unauthorized access to enterprise environments. Following initial access, the attackers deployed a malicious binary (rs.win32.exe), performed DLL sideloading using the legitimate Windows Parental Controls Monitor (WpcMon.exe), established persistence via registry Run keys, and beaconed to a C2 server.

Attack Chain

  1. Initial access via exploitation of camera management software (CMS.exe).
  2. Deployment of malicious binary 'rs.win32.exe' to the endpoint.
  3. Execution of 'WpcMon.exe' to perform DLL sideloading in the user's AppData directory.
  4. Establishment of persistence through Windows registry Run keys.
  5. Establishment of outbound C2 communication to '144.172.116.37'.

Recommendation

  • Inventory and restrict access to camera management software; treat these applications as part of the enterprise attack surface.
  • Implement monitoring for unauthorized process executions originating from 'CMS.exe'.
  • Restrict execution of binaries and DLLs from user-writable paths such as '%AppData%'.
  • Monitor for registry modifications targeting 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run' or 'HKLM\Software\Microsoft\Windows\CurrentVersion\Run'.
  • Block the identified C2 IP address '144.172.116.37' at the network perimeter.
]]>highadvisoryinitial-accesspersistencec2defense-evasionmalware