Attackers have been breaking into business networks through camera management software, according to new research from security firm Huntress, which traced several incidents in September and October back to a compromised application.

An unidentified application

The company’s analysts haven’t been able to confidently determine which software it was, and because no logs associated with the application could be found, they also couldn’t pinpoint how the attackers compromised it.

The software’s executable – CMS.exe – “did not contain an embedded File Version Information section,” but some of the strings it contained seem to point to a possible vendor: a Korean company selling analog and IP cameras and digital and network video recorders.

The strings include a web address on a domain tied to the company, and a CMS package with the same telltale strings is offered for download by a possibly associated brand. Still, Huntress analysts stressed that this is only a possible source, not a confirmed vendor connection.

Risk mitigation and threat hunting

What the analysts could see, though, was what the attackers did once they were in, and that activity left consistent traces defenders can look for:

  • A file named rs.win32.exe, used as a reverse shell, dropped in the user’s AppDataRoamingCMSRemoteSetup folder and launched by CMS.exe
  • A copy of the legitimate Microsoft file WpcMon.exe in AppDataLocalMicrosoftWpcMon, rather than in its usual location in the Windows system folder
  • Two malicious DLLs, IPHLPAPI.DLL and samcli.dll, disguised as zlib compression libraries and sideloaded by WpcMon.exe
  • A value in the user’s Run registry key pointing to the newly installed WpcMon.exe, so the malware starts at every login
  • Outbound connections to the command-and-control server at 144.172.116[.]37

“Security teams often focus on the software they know attackers target. But security weaknesses can exist in any software that touches an organization’s environment, including tools that may not be viewed as part of the ‘traditional’ attack surface,” the analysts noted, and advised organizations to treat camera systems and their management applications as potential entry points into their environments.

“Businesses should inventory the software, restrict its access, and monitor for unusual processes and outbound connections. Where practical, organizations should also use application control to prevent unapproved executables and DLLs from running in user-writable paths, and investigate the sequence of CMS.exe, rs.win32.exe, abnormal WpcMon.exe, and unapproved outbound connections,” they concluded.

Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!