This finding stems from an analysis of several incidents that occurred during September and October. The incidents were traced back to a specific, but currently unidentified, application.
The analysts at Huntress have been unable to definitively name the software in question. Furthermore, the absence of logs related to the application prevented the researchers from determining the method of the initial compromise.
The executable associated with this software was identified as CMS.exe.
This information was initially published in a post titled "Compromised camera management software gives attackers a way into corporate networks" on Help Net Security.
The use of seemingly benign infrastructure components, such as camera management tools, to facilitate network intrusion represents a growing vector for threat actors targeting enterprise environments.
Market participants should note the difficulty in attribution, given the lack of forensic logging associated with the exploited application.
