Executive Summary
Huntress analysts have identified a campaign where attackers gain initial access by compromising legitimate camera management software (CMS.exe), likely associated with the vendor 3R Global. This platform is being utilized as a gateway into broader enterprise environments that often overlook physical security management tools as part of the attack surface.
Following initial access, the attackers deploy a reverse shell (`rs.win32.exe`) and leverage DLL sideloading by placing a legitimate Windows Parental Control Monitor binary (`WpcMon.exe`) in user-writable AppData folders. The attack incorporates malicious versions of `IPHLPAPI.DLL` and `samcli.dll` to establish beaconing to a command-and-control server, alongside registry Run Key persistence.
The use of trusted Windows binaries and third-party management tools highlights a significant risk for organizations that treat camera systems as isolated appliances. If not adequately secured, these platforms provide a direct path for malware deployment and persistent access.