Huntress Details Attacks Using Camera Management Software for Initial Access
Summary
Huntress describes multiple incidents it linked to compromised camera-management software used for initial access. Attackers dropped rs.win32.exe, sideloaded DLLs through WpcMon.exe, added Run-key persistence and beaconed to a C2; the software vendor remains uncertain.
Key points
- Huntress observed multiple incidents in September and October and assessed that compromised camera management software was the initial access vector.
- Attackers dropped rs.win32.exe into a user-writable AppData folder and used it to launch a remote-control session.
- Attackers placed legitimate WpcMon.exe in AppData and used it to sideload modified IPHLPAPI.DLL and samcli.dll files with beaconing functionality.
- A user Run key was modified for persistence; Huntress observed the process chain involving CMS.exe, rs.win32.exe, and WpcMon.exe.
- The observed C2 address was 144.172.116[.]37.
- Huntress could not identify the software vendor or review application logs. Kvision[.]ai was a possible software source, not a confirmed relationship.
- Huntress recommends inventorying and restricting camera-management software, controlling executables and DLLs in user-writable paths, and investigating unusual processes and outbound connections.
Article Details
- Attack Vectors
- Huntress assessed that attackers compromised camera management software to gain initial access across multiple incidents.
- After access, attackers dropped rs.win32.exe into the user's AppData\Roaming\CMS\RemoteSetup folder and launched it with a command line that included a remote IP address and port; Huntress characterized this as a reverse shell.
- Attackers placed WpcMon.exe in an AppData folder and used it to DLL-sideload the malicious libraries IPHLPAPI.DLL and samcli.dll, which beaconed to a C2 server.
- Attackers established persistence by adding a reference to WpcMon.exe beneath the user's Run registry key.
- Defensive Notes
- Inventory camera management software and restrict access to it.
- Use application control, where practical, to prevent unapproved executables and DLLs from running in user-writable paths.
- Monitor for unusual processes and outbound connections; investigate the sequence of CMS.exe, rs.win32.exe, abnormal WpcMon.exe, and unapproved outbound connections.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 144[.]172[.]116[.]37 | C2 IP address observed beaconing from impacted endpoints. |
| SHA256 | 1fb4af4862643dcab1459872f723f574f1a588855b020916b600df5c20681144 | SHA256 hash of rs.win32.exe, which the attackers dropped in users' AppData folders. |
| SHA256 | 70b2345302264c41504d59e6a63d6d908969740424b42b7373f10b4c8d74c87a | SHA256 hash identified for IPHLPAPI.DLL, described as a malicious DLL used in DLL sideloading. |
| SHA256 | 8f8e88c54a9c56174974711eff99b4beb79536642fcca1902acdc3d4b1fd1035 | SHA256 hash identified for samcli.dll, described as a malicious DLL used in DLL sideloading. |
MITRE ATT&CK
T1105 · Ingress Tool TransferAttackers dropped rs.win32.exe, WpcMon.exe, and malicious DLLs onto the endpoint.T1547.001 · Registry Run Keys / Startup FolderAttackers added a reference to WpcMon.exe beneath the user's Run registry key for persistence.T1574.002 · DLL Side-LoadingAttackers used the legitimate WpcMon.exe binary to sideload the malicious IPHLPAPI.DLL and samcli.dll.