Attackers Are Using Compromised Camera Management Software as a Way Into Business Networks

Huntress analysts observed a handful of incidents in September and October in which attackers appear to have gained initial access through camera management software (CMS.exe). Across all cases, the assessment was that a threat actor had compromised a legitimate camera management system. Huntress notes that security weaknesses can exist in any software that touches an organisation's environment, including tools that are not seen as part of the traditional attack surface.

The attack chain was loosely consistent across the incidents. After gaining access, the attackers dropped a file named rs.win32.exe on the endpoint. They then abused a legitimate Windows binary, WpcMon.exe, to sideload malicious DLLs from the user's AppData folder. The attackers set up persistence using a Run Key and ran a beacon that contacted a command-and-control server at 144.172.116[.]37. Mixing malicious code with trusted Windows components helps attackers evade detection.

Huntress advises treating camera systems and their management applications as part of the enterprise attack surface rather than isolated appliances. Organisations should inventory this software and restrict access to it, prevent executables and DLLs from running in user-writable paths where possible, and investigate unusual process chains and outbound connections.