Camera Management Software Compromise Leads to Malware Deployment

Attackers compromised camera management software (CMS.exe) to gain initial access to multiple organizations. They deployed malware (rs.win32.exe) into user AppData directories and used DLL sideloading with the legitimate Windows binary WpcMon.exe and malicious DLLs to establish beaconing to a command-and-control server. Persistence was maintained via Run Key registry modifications. The affected camera management software, possibly linked to 3R Global and kvision.ai, lacked sufficient security controls and logging. Organizations are advised to treat camera systems and their management platforms as critical attack surfaces and implement access controls and monitoring to detect unusual activity.

• Iranian State-Aligned Threat Actor Masquerading as Dubai Airports IT Department Delivering Trojanized Coding Challenges - Blinder Tunnel Campaign Targeting Iraqi Critical InfrastructureMalware2026-10-07
• China-nexus UAT-11587 targets government and policy organizations across Asia with Antino backdoorMalware2026-09-30
• Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFixMalware2026-09-29
• NeedyMantis: Unpacking a post-compromise malware family used in targeted operationsMalware2026-09-28
• Inside The Gentlemen: Undisclosed TukTuk C2 Framework and EDR Neutralization ResearchMalware2026-09-02