Camera Management Software Compromise Leads to Malware Deployment

Attackers compromised camera management software and used it as initial access to deploy malware in a series of incidents observed in September and October, Huntress reports. From the compromised CMS.exe, attackers dropped a reverse-shell file, then abused the legitimate Windows binary WpcMon.exe for DLL sideloading of modified libraries that beaconed to a command-and-control server, with persistence through a Run registry key; Huntress says defenders should inventory camera management platforms, restrict their access and monitor for the observed process sequence.