Security Researchers Warn of Hackers Targeting Camera Management Software

Overview of the Threat

Security researchers at Huntress have identified an ongoing campaign where attackers are exploiting vulnerabilities in camera management software to gain unauthorized access to company networks. Between September and October 2026, analysts observed incidents where threat actors used these management systems as a gateway to establish persistence within business infrastructure.

Attack Methodology

• Initial Access: Attackers leverage legitimate, yet currently unidentified, camera management software to gain a foothold.
• Reverse Shell: Once inside, a file named rs.win32.exe is executed to create a reverse shell, connecting the system to an external IP address.
• DLL Sideloading: Threat actors deploy WpcMon.exe—a legitimate Windows utility—to load malicious DLL files (IPHLPAPI.DLL and samcli.dll). These libraries are designed to communicate with external command-and-control servers.
• Persistence: The attackers modify the Windows Registry's 'Run' key, ensuring the malicious processes restart automatically whenever a user logs in.

Uncertainties

Investigators have not yet confirmed the specific name or vendor of the exploited software. While strings within the executables suggest a potential link to the Korean company 3R Global, researchers could not definitively confirm the source of the downloads. Due to the lack of identifying version information in the files, the full scale of the campaign remains unknown.

Defensive Recommendations

Experts urge IT administrators to:

• Maintain a strict inventory of all camera management software currently in use.
• Restrict network access for camera systems, treating them as high-security assets.
• Implement application control to block unauthorized executables from running in user-accessible paths.
• Monitor for abnormal outbound connections, especially those originating from unexpected processes like WpcMon.exe.