Attackers break in through Windows camera management software (CMS.exe) and plant a reverse shell and sideloaded beacons (Huntress)

Huntress (27 Oct 2026) saw several customer incidents in September and October 2026 that began in camera management software installed at C:\Program Files (x86)\CMS\CMS.exe. The vendor is not confirmed: strings in the file point to 3r-dataware[.]com (Korean company 3R Global), and a CMS package from kvision[.]ai is a possible source. How the software was compromised is unknown, because there were no application logs. After getting in, the attackers dropped rs.win32.exe (a reverse shell) in AppData\Roaming\CMS\RemoteSetup, copied the legitimate Windows WpcMon.exe into AppData\Local\Microsoft\WpcMon to load modified IPHLPAPI.DLL and samcli.dll beacons, added a Run-key entry to survive restarts, and beaconed to 144.172.116[.]37. At risk: organizations running this CMS camera/NVR client on Windows endpoints.

Summary written from the sources below. Check the originals before acting.