{"id":"CMP-202610-attackers-break-in-through-windows-camera-management-softwar","kind":"campaign","aliases":[],"related":[],"title":"Attackers break in through Windows camera management software (CMS.exe) and plant a reverse shell and sideloaded beacons (Huntress)","description":null,"summary":"Huntress (27 Oct 2026) saw several customer incidents in September and October 2026 that began in camera management software installed at C:\\Program Files (x86)\\CMS\\CMS.exe. The vendor is not confirmed: strings in the file point to 3r-dataware[.]com (Korean company 3R Global), and a CMS package from kvision[.]ai is a possible source. How the software was compromised is unknown, because there were no application logs. After getting in, the attackers dropped rs.win32.exe (a reverse shell) in AppData\\Roaming\\CMS\\RemoteSetup, copied the legitimate Windows WpcMon.exe into AppData\\Local\\Microsoft\\WpcMon to load modified IPHLPAPI.DLL and samcli.dll beacons, added a Run-key entry to survive restarts, and beaconed to 144.172.116[.]37. At risk: organizations running this CMS camera/NVR client on Windows endpoints.","severity":"high","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-10-29T15:48:11+00:00","products":[{"name":"CMS camera management software (3R Global / kvision.ai)","fixed":[],"vendor":"3R Global (unconfirmed)"},{"name":"Windows","fixed":[],"vendor":"Microsoft"}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"Check whether C:\\Program Files (x86)\\CMS\\CMS.exe is installed. Hunt for CMS.exe starting rs.win32.exe, for files under AppData\\Roaming\\CMS\\RemoteSetup\\, for WpcMon.exe running from AppData\\Local\\Microsoft\\WpcMon\\ with IPHLPAPI.DLL or samcli.dll beside it, for a Run-key entry pointing to that WpcMon.exe, and for connections to 144.172.116[.]37. SHA256 hashes: rs.win32.exe 1fb4af4862643dcab1459872f723f574f1a588855b020916b600df5c20681144, samcli.dll 8f8e88c54a9c56174974711eff99b4beb79536642fcca1902acdc3d4b1fd1035, IPHLPAPI.DLL 70b2345302264c41504d59e6a63d6d908969740424b42b7373f10b4c8d74c87a.","fix":"List every host running camera management software. Cut off its internet and network exposure and isolate it from the rest of the environment. Block 144.172.116[.]37. Use application control to stop EXEs and DLLs from running in user-writable AppData paths. If you find the indicators, isolate the host, remove the Run key and the dropped files, and rotate credentials used on it. No vendor fix is known.","status":"open","published_at":null,"first_seen_at":"2026-10-29T15:48:11+00:00","triaged_at":"2026-10-29T15:48:11+00:00","updated_at":"2026-10-29T15:48:11+00:00","category":"vendor","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-202610':20A '144.172.116':156B '2026':45B,54B '27':43B '37':157B '3r':34A,81B,86B '3r-dataware':80B 'add':144B 'ai':94B 'appdata':123B,133B 'applic':110B 'attack':1A,116B 'attackers':22A 'attackers-break-in-through-windows-camera-management-softwar':21A 'beacon':17A,143B,154B 'began':56B 'break':2A,23A 'c':63B 'camera':6A,27A,31A,58B 'camera/nvr':164B 'campaign':38B 'client':165B 'cmp':19A 'cms':30A,67B,90B,125B,163B 'cms.exe':9A,68B 'com':83B 'compani':85B 'compromis':103B 'confirm':73B 'copi':127B 'custom':48B 'datawar':82B 'drop':117B 'earli':40B 'early-warn':39B 'endpoint':168B 'entri':149B 'file':65B,77B 'get':113B 'global':35A,87B 'huntress':18A,42B 'in':24A 'incid':49B 'instal':61B 'iphlpapi.dll':140B 'key':148B 'korean':84B 'kvision':93B 'kvision.ai':36A 'legitim':129B 'load':138B 'local':134B 'log':111B 'manag':7A,59B 'management':28A,32A 'microsoft':135B 'modifi':139B 'oct':44B 'octob':53B 'organ':160B 'packag':91B 'plant':11A 'point':78B 'possibl':97B 'program':64B 'remotesetup':126B 'restart':152B 'revers':13A,120B 'risk':159B 'roam':124B 'rs.win32.exe':118B 'run':147B,161B 'run-key':146B 'samcli.dll':142B 'saw':46B 'septemb':51B 'sever':47B 'shell':14A,121B 'sideload':16A 'softwar':8A,29A,60B,101B 'software':33A 'sourc':98B 'string':74B 'surviv':151B 'through':25A 'unknown':105B 'vendor':70B 'warn':41B 'window':5A,130B,167B 'windows':26A,37A 'wpcmon':136B 'wpcmon.exe':131B 'x86':66B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"first_public_at":"2026-10-27T13:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202610-attackers-break-in-through-windows-camera-management-softwar","url":null,"severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-29T15:48:11+00:00","fetched_at":"2026-10-29T15:48:11+00:00","note":null}],"documents":[{"id":17254,"url":"https://x.com/HuntressLabs/status/2115822766637359372","title":"@HuntressLabs: Lights, camera, attack? We recently zoomed in on a campaign that compromises cam","kind":"post","source":"x","publisher":null,"text":"Lights, camera, attack? We recently zoomed in on a campaign that compromises camera management software to gain initial access into victim environments.\n\n📸 Read the blog for a snapshot of this easily overlooked attack surface: https://t.co/m9QuMj0WYu https://t.co/IzJyqAb7QI\n\nlikes 10 reposts 2","published_at":"2026-10-29T15:07:12+00:00","relation":"describes","confidence":null,"note":null},{"id":9609,"url":"https://www.huntress.com/blog/camera-management-software-compromise-malware","title":"Who Watches the Watchers? Camera Management Software Compromise Leads to Malware Deployment (Huntress)","kind":"blog","source":"blog","publisher":null,"text":"Huntress saw multiple incidents (Sept-Oct 2026) where attackers compromised camera management software C:\\Program Files (x86)\\CMS\\CMS.exe (vendor unconfirmed; strings point to 3r-dataware[.]com / 3R Global, possible download source kvision[.]ai CMS package). Post-compromise: rs.win32.exe dropped in AppData\\Roaming\\CMS\\RemoteSetup\\ (reverse shell, -p 8000 -r admin), legitimate WpcMon.exe dropped in AppData\\Local\\Microsoft\\WpcMon\\ to sideload malicious IPHLPAPI.DLL and samcli.dll (modified zlib), Run key persistence, C2 144.172.116[.]37. Hashes: rs.win32.exe 1fb4af4862643dcab1459872f723f574f1a588855b020916b600df5c20681144; samcli.dll 8f8e88c54a9c56174974711eff99b4beb79536642fcca1902acdc3d4b1fd1035; IPHLPAPI.DLL 70b2345302264c41504d59e6a63d6d908969740424b42b7373f10b4c8d74c87a. Exact initial-access weakness unknown.","published_at":"2026-10-27T13:00:00+00:00","relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}