A CCTV software attack has given attackers persistent access to company networks through camera management software installed on Windows computers. Multiple real-world intrusions were observed during September and October 2026.
The incidents show that the risk is not limited to internet-connected cameras themselves. Software used to view and manage CCTV equipment can also become an entry point, particularly when it runs on a workstation connected to the wider business network.
How the CCTV software attack was discovered
Huntress disclosed the campaign on 27 October 2026 after investigating several incidents across customer environments. Its analysis traced the suspicious activity to legitimate camera management software identified on affected systems as CMS.exe.
The application was installed at C:\Program Files (x86)\CMS\CMS.exe. Huntress assessed that the software had been compromised and was being used to launch malicious files. However, limited application logging meant investigators could not determine exactly how the application, its update process or its environment was initially breached.
The CCTV software attack was not a theoretical vulnerability or a proof of concept. The activity was detected in operational environments, where attackers obtained outbound remote access and established persistence on Windows hosts.
Follow-on reporting on 28 October 2026 documented additional artefacts that organisations can use to investigate their systems. Wider coverage followed on 29 October 2026, bringing attention to the risk posed by camera management applications installed on business computers.
What remains unknown
The exact product name, software version and vendor have not been confirmed. CMS.exe did not contain file version information, making identification more difficult.
Researchers found an embedded reference to cloudapi.3r-dataware[.]com, a domain associated with a Korean vendor, as well as the string developerslavery. Huntress cautioned that the domain reference alone does not establish who developed or supplied the application. No official vendor advisory or product-specific patch has been identified for these incidents.
CCTV software attack chain explained
The observed intrusion chain began when CMS.exe executed a file called rs.win32.exe. This executable behaved as a reverse shell, creating an outbound connection that could allow an attacker to issue commands remotely from outside the organisation.
The reverse shell was placed beneath the user profile in %AppData%\Roaming\CMS\RemoteSetup. This is significant because user-writable directories are commonly abused to store and run malware without requiring files to be placed in more tightly controlled Windows system locations.
WpcMon.exe used for DLL sideloading
After gaining access, the attackers abused WpcMon.exe, a legitimate Microsoft Windows component. They copied it into %LocalAppData%\Microsoft\WpcMon, rather than running it from its normal Windows directory.
Malicious DLL files were then placed beside the relocated executable. When WpcMon.exe started, Windows loaded the attacker-controlled libraries because the legitimate program searched its local directory for the required components.
This technique is known as DLL sideloading. It allows malicious code to execute inside the context of a trusted and correctly signed program, which can make activity appear less suspicious to users and some security controls.
The malicious files included IPHLPAPI.DLL and samcli.dll. They were presented as zlib-related components but formed part of the malicious loading chain. The use of a recognised Microsoft executable did not make the relocated files safe.
Persistence and command and control
The attackers created a Run key within the current user’s registry hive. This key pointed to the relocated WpcMon.exe, causing the sideloading chain to execute again when the user logged on.
This persistence mechanism helped the CCTV software attack survive restarts and maintain access without relying on the original CMS.exe process every time. Investigators also observed malicious communications with the command and control IP address 144.172.116.37.
No threat group has been publicly attributed to the campaign. There is also no disclosed CVE or public exploit associated with the incidents, because the exact method used to compromise the deployed camera application remains unknown.
Timeline and current exploitation status
The following timeline separates the confirmed CMS.exe intrusions from other camera-related activity that provides context for the broader threat:
- June to July 2026: A separate campaign known as Operation CameraSwarm compromised more than 14,000 Dahua cameras. It was not the same activity as the CMS.exe incidents.
- 14 September 2026: Belgium’s Centre for Cybersecurity Belgium warned that compromised IP cameras could be used as pivot points into corporate networks.
- September to October 2026: Huntress investigated multiple intrusions linked to compromised Windows camera management software.
- 27 October 2026: Huntress published its investigation into the CMS.exe compromise and malware deployment chain.
- 28 October 2026: Further technical coverage documented file locations, DLL names and the persistence mechanism.
- 29 October 2026: The CCTV software attack received wider reporting for a general professional audience.
Exploitation is confirmed in the wild. However, the number of affected organisations has not been disclosed, and the available evidence does not show that every installation named CMS.exe is malicious or compromised.
Indicators linked to the CCTV software attack
Security teams can use the reported artefacts to support threat hunting. Each indicator should be considered alongside process execution, file creation and network evidence, because filenames can also appear in legitimate contexts.
- Application: CMS.exe at C:\Program Files (x86)\CMS\CMS.exe.
- Suspected reverse shell: rs.win32.exe beneath %AppData%\Roaming\CMS\RemoteSetup.
- Relocated Microsoft binary: WpcMon.exe beneath %LocalAppData%\Microsoft\WpcMon.
- Malicious libraries: IPHLPAPI.DLL and samcli.dll placed beside WpcMon.exe.
- Persistence: A current-user Run key referencing the relocated WpcMon.exe.
- Command and control: Connections to 144.172.116.37.
- Embedded artefact: cloudapi.3r-dataware[.]com within CMS.exe, which does not by itself identify the vendor or indicate malicious communication.
Why this camera management compromise matters
Camera software may be overlooked because it supports physical security rather than core business operations. Yet a Windows management client can have network access, user privileges and connectivity to cameras, recorders and other internal systems.
For smaller organisations, CCTV clients may run on ordinary office workstations while cameras and business devices share the same network. In that configuration, compromising the management application can provide an immediate route towards other systems.
What organisations should do now
Organisations using Windows-based CCTV management clients should identify where they are installed and check for the reported files, paths, registry changes and network connections. CMS.exe launching rs.win32.exe, or WpcMon.exe running from a user profile, should receive urgent investigation.
- Restrict camera management software to authorised systems and users.
- Separate CCTV cameras, recorders and management hosts from business networks.
- Block executables and DLLs from launching in user-writable directories where operationally possible.
- Monitor camera applications for unusual child processes and outbound connections.
- Preserve relevant endpoint, registry and network evidence before removing suspicious files.
As no confirmed vendor patch is available, organisations should not wait for a product advisory before investigating. The immediate priority is to determine whether the observed CCTV software attack artefacts are present and to contain any affected Windows host.
Originally reported by TechRadar.
