Hackers Compromise Camera Management Software to Deploy Malware on Windows Computers

Hackers have compromised camera management software to deploy malware on Windows computers, using a legitimate Microsoft program to run malicious code and maintain access.

The activity shows how software used to manage surveillance systems can become an entry point into business networks. The incidents followed a similar pattern: attackers gained access through the camera application, deployed a suspected reverse shell, and used DLL sideloading to contact an outside server.

Like earlier cases involving abuse of monitoring tools, the activity highlights risks surrounding software trusted for routine operations.

Researchers from Huntress identified the malware activity across several customer environments during September and October 2026.

In their October 27 investigation, Harlan Carvey and Lindsey O’Donnell-Welch described a handful of incidents linked to compromised camera management software, while noting important gaps in understanding the initial break-in.

Hackers Compromise Camera Management Software

The affected application lacked embedded file version information, preventing researchers from confirming its full product name or developer.

They also could not locate application logs, leaving the exact method used to compromise the software unresolved. The report does not identify a specific vulnerability or CVE.

Investigators found strings connecting the executable to a domain associated with Korean company 3R Global. A camera management package available through another website contained matching strings.

However, Huntress stressed that these overlaps did not establish the vendor’s identity or prove where affected customers obtained their software.

After gaining access, attackers placed an executable inside a user’s application data directory. Its command line specified a remote address, a connection port, and authentication values.

Combined with its location in a writable folder, these details led researchers to assess the program as a reverse shell. The attackers then copied Windows Parental Control Monitor into another application data folder.

Huntress verified that this executable was a genuine Microsoft file, but its unusual location exposed the abuse. Similar VLC and VMware sideloading cases demonstrate why a trusted executable alone cannot establish that nearby libraries are safe.

Here, the Microsoft program loaded malicious DLLs placed alongside it. The libraries resembled legitimate zlib compression components but had been modified to periodically contact a command-and-control server.

This technique, called DLL sideloading, lets attackers execute their code through an otherwise legitimate application.

The distinction matters because the executable itself was not the malicious payload. Its role was to load attacker-controlled libraries from the surrounding folder.

Checking the Microsoft file’s identity without examining its location, loaded DLLs, parent process, and network activity would leave out the evidence that connected an apparently normal Windows component to the wider infection chain.

Persistence, Detection, and Defensive Priorities

Attackers maintained access by adding the relocated Microsoft executable to the user’s Run registry key. Windows would then launch it whenever that user signed in, restarting the loading chain.

Every investigated incident involved communication with the same command-and-control IP address listed below. For defenders, the most useful signal is the connected sequence of events rather than any single filename.

Camera software launching an unexpected executable, followed by a Microsoft component running from a writable folder and making unusual outbound connections, warrants investigation. Huntress specifically recommends examining that process chain.

Organizations should inventory camera management applications, restrict access, and monitor their network activity. Earlier EggStreme DLL sideloading attacks also abused a Windows executable from an application data folder, reinforcing the value of checking execution locations.

Where practical, Huntress recommends application controls that block unapproved executables and DLLs in user-writable directories. The investigation also leaves limits on what organizations can conclude.

Huntress did not establish how the initial camera software compromise occurred, and the available evidence does not justify describing this as a confirmed vendor supply-chain breach.

The immediate lesson is narrower: camera management applications need the same endpoint oversight as other business software, rather than being overlooked entirely.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Hackers Compromise Camera Management Software to Deploy Malware on Windows Computers appeared first on Cyber Security News.