Securitymalwarecameraswindowsincident-response
Attackers Got In Through a Company's Camera-Management Software, Then Hid Behind a Copy of Windows' Parental Controls Monitor
Huntress says attackers used a compromised camera management application as their way into several customer networks in September and October, then loaded their malware through a legitimate Windows parental-controls file placed in the wrong folder.
Huntress researchers Harlan Carvey and Lindsey O’Donnell-Welch published the write-up on October 27. They describe a handful of incidents across multiple customers in September and October, all starting the same way: “a threat actor had compromised a legitimate camera management system as their initial access vector.”
The first thing that looked wrong was a file everyone has. WpcMon.exe is the Windows Parental Control Monitor, a real Microsoft program. Huntress found a copy running from a user’s own app-data folder, which the researchers call “not the folder where we normally expect to see this file.” Following the chain of programs that launched it led back to CMS.exe, the camera management app, along with a helper program sitting in a folder any user can write to.
The trick is an old one. Attackers put a trusted program next to a malicious file it will load by name, so the bad code runs under a good program’s cover. They then set it to start again at every login.
Two big gaps remain. “Huntress analysts were unable to determine the full name or creator/vendor of the software,” the researchers write, and “we were also unable to locate logs associated with the application.” So the camera product is unnamed, and how the attackers first got into it is unknown.
“Security teams often focus on the software they know attackers target,” Huntress writes. Its advice is plain: inventory every piece of camera software, limit who can reach it, block programs from running out of folders users can write to, and watch for odd chains of programs and unexpected outbound connections. The researchers want companies to “treat cameras and their management platforms as potential entry points into their broader environment.”
The pattern keeps widening from routers and VPNs to anything with a Windows box behind it: badge readers, building controls, the PC in the back office that runs the security cameras. Each one is somebody’s job to install and nobody’s job to watch. The vendor behind this one still hasn’t been named, and nobody yet knows how many other offices are running it.