Camera Management Software Compromise Leads to Malware Deployment
Huntress, Tuesday, October 27th, 2026
Huntress reports attackers compromising camera management software for initial access, then sideloading malicious DLLs to deploy malware.
Huntress observed several incidents in September and October in which attackers appear to have gained initial access by compromising camera management software (CMS.exe).
After access, attackers dropped rs.win32.exe, abused the legitimate Windows binary WpcMon.exe to sideload malicious DLLs in the AppData path, set Run Key persistence and beaconed to a command-and-control server.
Huntress could not definitively identify the software vendor, though strings pointed to a possible link to 3R Global and the kvision.ai website.
It advises treating camera systems as part of the attack surface, restricting access, blocking executables in user-writable paths and investigating unusual process chains.