Search — “rs.win32.exe”

Huntress observed Sept–Oct incidents where a threat actor compromised camera management software (CMS.exe, possibly linked to 3R Global/kvision.ai) as initial access. Post-compromise, rs.win32.exe was dropped in AppData\Roaming\CMS\RemoteSetup and run as a reverse shell, legitimate WpcMon.exe was dropped in AppData\Local\Microsoft\WpcMon to sideload malicious IPHLPAPI.DLL and samcli.dll, a Run key provided persistence, and beacons went to 144.172.116[.]37. Hunt for the CMS.exe -> rs.win32.exe -> WpcMon.exe chain, WpcMon.exe outside System32, and Run key values pointing to AppData.