Management software for Korean CCTV and DVR systems has been used to drop a backdoor that steals passwords, cookies, card numbers and crypto wallet recovery phrases, according to a new analysis by AhnLab Security Intelligence Center (ASEC). AhnLab names the malware Wpcdoor and tracks the operator as Larva-26013.
The case builds on a disclosure by Huntress on October 27, 2026, which found malware being installed through CMS.exe, a component of the Central Management Software that a Korean CCTV and DVR maker ships with its products. AhnLab's own endpoint logs confirmed infections in Korea, and the company says Larva-26013 has also installed Wpcdoor in attacks outside the country. Neither Huntress nor AhnLab could establish a connection between the attack and the software vendor, and AhnLab says it remains unclear whether the attackers abused a vulnerability, a misconfiguration or a built-in feature.
Three hops from a DVR tool to a backdoor
The chain leans on DLL side-loading, a trick where a legitimate program is fooled into loading a malicious library sitting next to it. AhnLab describes the steps:
- While the CMS software installs its rs.win32.exe component, a malicious IPHLPAPI.DLL is downloaded into the %APPDATA%\CMS\RemoteSetup\ folder and side-loaded when rs.win32.exe runs.
- That first downloader fetches the legitimate Windows file WpcMon.exe plus a malicious samcli.dll, and runs WpcMon.exe so that it side-loads samcli.dll.
- samcli.dll downloads the final Wpcdoor backdoor and runs it in memory rather than writing it to disk.
Both downloaders talk to the command server with packets that start with the signature WPCF and decrypt payloads with the XOR key 0x82615458. AhnLab also found a sibling first stage named QtCore4.dll that fetches a second stage called rsaenh.dll instead.
What the backdoor goes looking for
Once running, Wpcdoor persists under the Run registry key as WpcMon, collects the machine's identifier, user name, computer name and OS version, takes a screenshot and sends it all home. Its command set covers screenshots, keylogging, clipboard theft and modification, file upload, download and search, command execution, port forwarding and a hidden remote desktop (HVNC) session.
One command steals credentials, cookies, browsing history and credit card numbers stored in web browsers. Another hunts through the Desktop, Downloads, Documents, Pictures, Videos, OneDrive and AppData folders for file names the operator supplies. A third scans process memory for ten wallet browser extensions, including MetaMask, Coinbase, Phantom and Trust, and then for a string pattern AhnLab assesses is likely the wallet's seed phrase.
Patch the DVR software and rotate its passwords
AhnLab advises users to apply the latest vendor patches for their software and operating systems, review the security settings of the affected management software, and immediately change any user names and passwords used in it and in related systems. Defenders can also hunt for WpcMon.exe or samcli.dll running from %LOCALAPPDATA%\Microsoft\WpcMon\, which is not where Windows keeps that binary, and for the mutex Global\81669d8b1539333e96b84c2e5c4dba5d.
The case is another reminder, after AhnLab's recent look at breaches that began at forgotten side systems in South Korea and Japan, that the boxes running cameras and recorders are rarely watched as closely as the machines they sit beside.
Indicators of compromise
- MD5: 0a9cb414b53536ad8fc217fc46a2cf56
- MD5: 14746a3aa1d1882a53d244b39e6895b3
- MD5: 2376baa1ba3a918f754db6bbc15cb1d7
- MD5: 6bafd9065f68ecd5778b8c828bb17134
- MD5: 7e42d1461339572111a2eedfff42e1c2
- C2: 144[.]172[.]116[.]37
- C2: 172[.]86[.]127[.]14 (also used for HVNC on port 8443)
- C2: 172[.]86[.]127[.]89
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.