Camera software running on an ordinary Windows PC can be the way into a whole network. On 27 October 2026 security company Huntress described several incidents from September and October in which attackers got in by compromising a camera management program, a Windows client used to view and manage video from cameras and recorders.

How the attack worked

In every case the chain began with CMS.exe, installed in C:\Program Files (x86)\CMS\. Huntress could not pin down the exact vendor. The file has no version information, and the program left no logs. Strings inside it point to the domain 3r-dataware.com, linked to the Korean company 3R Global, and a package with the same strings can be downloaded from kvision.ai. Huntress stresses that this is only a possible source, not a confirmed link to a specific manufacturer.

After the takeover the attackers followed the same steps each time:

  • They dropped rs.win32.exe into the user's AppData\Roaming\CMS\RemoteSetup folder and started it with a remote address, port 8000 and an admin login. Huntress treats this as a reverse shell.
  • They copied the genuine Microsoft program WpcMon.exe, part of the Windows parental controls, into AppData\Local\Microsoft\WpcMon, where it never normally lives.
  • Next to it they placed modified IPHLPAPI.DLL and samcli.dll files. They look like the zlib compression library, but contain code that regularly connects to a command server. The legitimate program loads them and runs the attackers' code (DLL sideloading).
  • They added WpcMon.exe to the user's Run key in the registry, so the backdoor starts at every sign-in.

In all incidents the infected computers talked to the same server, 144.172.116.37.

What this means outside a company network

The incidents were in business networks monitored by Huntress, but the pattern is familiar from homes too. Many cheap DVRs and NVRs come with a Windows "CMS" client of unknown origin that is rarely updated and often reaches out to the vendor's cloud. Such a program runs with the user's rights on a computer that also holds email, passwords and documents.

Huntress recommends:

  • keeping a list of camera software in use and limiting its network access,
  • blocking programs and libraries from running in folders the user can write to, such as AppData, where possible,
  • watching for the CMS.exe > rs.win32.exe > WpcMon.exe chain and unexpected outgoing connections.

At home the simplest step is to run the camera client on a separate machine or not at all, and to watch the cameras through a recorder's web interface or a local NVR such as Frigate. It is also worth checking a computer for WpcMon.exe in AppData and blocking the address above on the router.