Hackers are breaking into company networks via hacked CCTV camera software

Date:
Thu, 29 Oct 2026 16:05:00 +0000

Description:
Companies urged to treat cameras and their management platforms as potential entry points and secure them better.

FULL STORY ======================================================================Copy link Facebook X Whatsapp Reddit Pinterest Flipboard Threads Email Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter Attackers abused camera management software to gain initial access and establish persistence on networks Campaign used DLL sideloading and reverse shells to evade detection and maintain control Researchers urge treating camera systems as security-sensitive assets and monitoring them for abnormal activity Security researchers have warned of an ongoing campaign targeting an apparent vulnerability in camera management software. The vulnerability is being used for initial access, allowing threat actors to establish a foothold on company infrastructure.

The warning bells were sounded by security outfit Huntress, whose researchers Harlan Carvey and Lindsey O'Donnell-Welch said that in September and October 2026, they observed a handful of incidents originating from camera management software. In all cases the attackers abused a legitimate camera management system to side-load a malicious DLL file and gain access to the underlying system. Latest Videos From TechRadar Watch full video here: Who watches the watchmen? Surprisingly, the team could not determine which camera software
was being targeted, nor by whom.

Huntress analysts were unable to determine the full name or creator/vendor of the software, as the file did not contain an embedded File Version
Information section, they said. You may like Watch out TP-Link Tapo Camera vulnerabilities could let hackers spy inside homes, so patch now D-Link, Ubiquiti devices hijacked by hackers to plunder stolen bandwidth These
popular TP-Link home security cameras could be hacked to spy on you while you sleep, experts warn

However, they did find an executable containing a few notable strings, which led them to believe a Korean company called 3R Global could be involved. They couldnt confidently say that the Camera Management System (CMS) executable
was downloaded from that companys website, though.

Unfortunately, without knowing the exact name of the software being targeted, it is impossible to tell how many victims there were, or how big the attack surface is. Huntress handful designation does very little to explain just how dangerous this vulnerability is. Are you a pro? Subscribe to our newsletter Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed! Contact me with news
and offers from other Future brands Receive email from us on behalf of our trusted partners or sponsors By submitting your information you agree to the Terms & Conditions and Privacy Policy and are aged 16 or over.

While the lack of key data limited their visibility into exactly how the threat actors were compromising the software, they could see what they were doing once they were inside - launching a reverse shell and side-loading malicious DLLs.

Once the initial access had been established, the attackers would drop a file named rs.win32.exe to the endpoint and would launch it via a command line.
The command line would supply a remote IP address and port, and include an admin username.This led us to see this as a reverse shell, they said.

From there, they would drop a file called WpcMon.exe - a legitimate Microsoft Windows Parental Control Monitor file, used for parental-control and activity-monitoring features. In this case, however, the file is used to load malicious DLLs called IPHLPAPI.DLL and samcli.dll. On the surface, both
appear to be legitimate zlib compression libraries, but in fact, they were changed to provide beaconing, contacting the external C2 server from time to time. What to read next Hackers turn business backup servers into crypto
mines after sneaking malware disguised as Microsoft Edge Beware these new phishing attacks use a convincing fake Adobe Reader pages to trick victims into installing malware Hackers hide behind Microsoft's own websites to get past email filters and launch phishing campaigns Huntress watches the
watchmen watching the watchmen Part of the infection process also included creating persistence by adding a reference to the newly installed WpcMon.exe in a value beneath the user's Run key, the researchers explained. Threat actors typically add a program path to a user's Run registry key so Windows automatically launches their payload whenever that user signs in.

Side-loading malicious DLL files is a popular infection technique. Instead of deploying an obviously malicious program (which might get flagged by
antivirus products), the attackers drop a DLL file containing weaponized
code, and then get a legitimate program (such as the parental control software) to run it. Since the process starts with a legitimate executable,
it is more difficult to identify as malicious.

It does not guarantee evasion of security software, though.

Defenders should treat cameras and their management platforms as potential entry points into the broader business environment, Huntress warned. They should inventory the software, restrict its access, and monitor for unusual processes and outbound connections.

The researchers also advise defenders to use application control to prevent unapproved executables and DLLs from running in user-writeable paths, and to investigate the sequence of CMS.exe, rs.win32.exe, abnormal WpcMon.exe, and unapproved outbound connections. The best antivirus for all budgets Our top picks, based on real-world testing and comparisons

Read our full guide to the best antivirus 1. Best overall: Bitdefender Total Security 2. Best for families: Norton 360 with LifeLock 3. Best for mobile: McAfee Mobile Security Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.



======================================================================
Link to news story: https://www.techradar.com/pro/security/hackers-are-breaking-into-company-netwo rks-via-hacked-cctv-camera-software


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)