Attackers used camera management software to get into networks, Huntress says

Huntress says attackers compromised camera management software in several of its customers’ networks in September and October, and used it to plant malware. In each case they dropped a file Huntress took for a reverse shell, then loaded malicious DLLs through a legitimate Windows binary, WpcMon.exe, copied into the user’s AppData folder. The DLLs beaconed to one command server. Huntress couldn’t tell how the software was compromised or who makes it.

The software ran as CMS.exe from C:\Program Files (x86)\CMS\. Huntress found no vendor details in the file and no logs from the application, which limited what it could see of the break-in. It names a possible source for the software but says it can’t confirm a vendor link.

After getting in, the attackers dropped rs.win32.exe in the user’s AppData\Roaming\CMS\RemoteSetup folder and ran it with a remote address, port 8000 and an admin user name. Huntress reads that as a reverse shell.

They then copied the Windows Parental Control Monitor, WpcMon.exe, into AppData\Local\Microsoft\WpcMon\ beside two modified zlib DLLs, IPHLPAPI.DLL and samcli.dll. A value under the user’s Run key starts it at each sign-in.

The Parental Control Monitor normally lives in C:\Windows\System32. Huntress matched this copy’s hash to Microsoft’s own file, so its location, not its content, gave it away. The attackers used it for DLL sideloading, where a legitimate program loads a malicious DLL placed beside it.

Huntress says camera systems and their management apps belong to the enterprise attack surface rather than standing apart as isolated appliances. It calls the cases a handful of incidents, and doesn’t say what the attackers did once the malware was beaconing.