VULNpocalypse
MediumBreach / campaignMonitoring

Camera management software CMS.exe abused to deploy malware, Huntress reports

Huntress reports attackers abused camera management software CMS.exe to drop malware, hunt for rs.win32.exe and WpcMon.exe in AppData.

Published
Exploitation
Yes, according to Huntress, which says it observed incidents in multiple customer environments in September and October, entry method not confirmed

What happened

Huntress reports that it observed several incidents in which attackers appear to have gained initial access by compromising camera management software (Huntress). Huntress published the report on October 27, 2026. It says that in September and October it saw “a handful of incidents” across multiple customer environments that started from a program at C:\Program Files (x86)\CMS\CMS.exe. Its assessment is that in every case a threat actor had compromised a legitimate camera management system and used it as the initial access vector (Huntress).

Huntress describes the following post-compromise activity, which it says was loosely consistent across the incidents (Huntress):

  • A file named rs.win32.exe was dropped in C:\Users\<user>\AppData\Roaming\CMS\RemoteSetup\ and launched with command-line arguments that included an IP address, port 8000 and credential-like values.
  • The attackers abused the legitimate Windows binary WpcMon.exe to sideload malicious DLLs from the user’s AppData folder.
  • Persistence was set through a Run Key.
  • The malware beaconed to a command-and-control server at 144.172.116[.]37.

Several points remain unconfirmed:

  • Vendor: Huntress says it could not determine the full name or vendor of the software, because the executable has no embedded file version information. It found strings that reference the domain 3r-dataware[.]com, which it links to a Korean company called 3R Global. It also found matching strings in a “CMS” package offered on the kvision[.]ai download page. Huntress states that it presents this only as a possible source, “not as a definitive statement of a vendor relationship” (Huntress).
  • Entry method: Huntress also says it could not find logs for the application, so how the camera management software was compromised is not confirmed (Huntress).
  • Vendor response, CVE and fix: No vendor statement, CVE or fixed version is mentioned in the source, so all of these are not confirmed.
  • Victims: The number and identity of affected organizations are not confirmed.

Am I affected?

You may be affected if any of these apply, based on the indicators Huntress published (Huntress):

  • You have camera management software installed as C:\Program Files (x86)\CMS\CMS.exe, or a “CMS” package that contains references to 3r-dataware[.]com.
  • rs.win32.exe exists under C:\Users\<user>\AppData\Roaming\CMS\RemoteSetup\.
  • WpcMon.exe is running from a user AppData path and loading DLLs there.
  • You see unexpected Run Key entries pointing to AppData.
  • Endpoints have outbound connections to 144.172.116[.]37.

Which product versions are affected is not confirmed.

What to do now

  1. Inventory every system that runs camera management software. Huntress says these systems should be treated as part of the enterprise attack surface, not as isolated appliances (Huntress).
  2. Restrict who and what can reach that software, as Huntress recommends (Huntress).
  3. Search endpoints for the file paths, the WpcMon.exe sideloading pattern, the Run Key persistence and connections to the C2 address listed above.
  4. Where possible, block executables and DLLs from running in user-writable paths such as AppData, per Huntress (Huntress).
  5. Investigate unusual process chains that start from CMS.exe and any unexpected outbound connections (Huntress).
  6. If you find matches, handle the host as compromised under your normal incident response process.

Sources