Hackers are breaking into company networks using hacked CCTV camera software
follow us
Add us as a preferred source on Google
- Attackers abused camera management software to gain initial access and establish persistence on networks.
- The campaign used DLL sideloading and reverse shells to evade detection and maintain control.
- Researchers urge treating camera systems as security-sensitive assets and monitoring them for abnormal activity.
Security researchers have warned of an ongoing campaign targeting an apparent vulnerability in camera management software. The vulnerability is used for initial access, allowing threat actors to establish a foothold in the company’s infrastructure.
The warning bells were rung by the Huntress security team, whose researchers Harlan Carvey and Lindsey O’Donnell-Welch said that in September and October 2026 they observed a “handful of incidents” originating from the camera management software.
In all cases, attackers abused a legitimate camera management system to load a malicious DLL file and gain access to the underlying system.
Latest videos ofTechnologyRadar
Who watches over the watchers?
Surprisingly, the team was unable to determine which camera software was being attacked or by whom.
“Huntress analysts were unable to determine the full name or creator/vendor of the software, as the file did not contain an embedded file version information section,” they said.
However, they found an executable that contained some notable strings, leading them to believe that a Korean company called 3R Global might be involved. However, they could not say for sure that the Camera Management System (CMS) executable was downloaded from that company’s website.
Unfortunately, without knowing the exact name of the attacked software, it is impossible to know how many victims there were or how large the attack surface is. Huntress’ “handful” designation does little to explain how dangerous this vulnerability is.
While the lack of key data limited their visibility into exactly how the threat actors were compromising the software, they could see what they were doing once inside: launching a reverse shell and loading malicious DLLs.
Once initial access is established, attackers would place a file called rs.win32.exe on the endpoint and execute it via a command line. The command line would provide a remote IP address and port, and include an administrator username. “This led us to view this as a reverse shell,” they said.
From there, they would drop a file called WpcMon.exe, a legitimate Microsoft Windows Parental Control Monitor file, used for parental control and activity monitoring functions. However, in this case, the file is used to load malicious DLL files named IPHLPAPI.DLL and samcli.dll. At first glance, both appear to be legitimate zlib compression libraries, but in fact, they were changed to provide beacons, contacting the external C2 server from time to time.
Hunter watches the watchers watching the watchers
“Part of the infection process also included creating persistence by adding a reference to the newly installed WpcMon.exe in a value below the user’s Run key,” the researchers explained. “Threat actors typically add a program path to a user’s Run registry key so that Windows automatically starts its payload whenever that user logs on.”
Sideloading malicious DLL files is a popular infection technique. Instead of deploying an obviously malicious program (which could be detected by antivirus products), attackers place a DLL file containing weaponized code and then obtain a legitimate program (such as parental control software) to execute. Since the process starts with a legitimate executable, it is more difficult to identify it as malicious.
However, it does not guarantee evasion of security software.
Advocates should treat chambers and their management platforms as potential entry points into the broader business environment, Huntress cautioned. They must inventory the software, restrict its access, and monitor for unusual processes and outgoing connections.
The researchers also advise defenders to use application control to prevent unapproved DLLs and executables from running in user-writable paths, and to investigate the sequencing of CMS.exe, rs.win32.exe, abnormal WpcMon.exe, and unapproved outgoing connections.
The best antivirus for all budgets
Follow TechRadar on Google News and add us as a preferred source to receive news, reviews and opinions from our experts in your feeds.
Post Comment