Hackers Exploit Camera Software to Deploy Malware via DLL Sideloading
Attackers are compromising camera management software to install malware on Windows systems, leveraging legitimate Microsoft executables for persistence.
Security researchers have identified a campaign where threat actors are exploiting vulnerabilities in camera management software to deploy malware onto Windows computers. This tactic allows attackers to gain initial access through the camera application, establish a reverse shell, and then use a technique known as DLL sideloading with a legitimate Microsoft program to maintain persistence on compromised systems. The incidents, observed by Huntress across several customer environments in September and October 2026, highlight the risks associated with software used for managing surveillance systems.
The exact method used to compromise the camera management software remains unclear, as the affected application lacked embedded file version information and application logs, preventing researchers from definitively identifying the product or developer. While strings within the executable pointed to a domain associated with the Korean company 3R Global, and a matching package was found on another website, Huntress stressed that this did not confirm a supply-chain breach or the vendor's identity.
Following initial access, attackers deployed a suspected reverse shell executable into a user's application data directory. This program contained command-line arguments specifying a remote address, port, and authentication values, indicating its malicious intent. The attackers then copied a genuine Microsoft file, Windows Parental Control Monitor (WpcMon.exe), into another application data folder.
The core of the attack lies in DLL sideloading. The legitimate Microsoft executable, when launched from an unusual location, loaded malicious DLLs that were placed alongside it. These DLLs, disguised to resemble legitimate zlib compression components, were modified to periodically communicate with a command-and-control (C2) server. This technique abuses the trust placed in signed, legitimate executables by loading attacker-controlled libraries from the same directory.
To ensure persistence, the attackers added the relocated Microsoft executable to the user's Run registry key. This ensures that the malicious chain of execution restarts every time the user logs into their Windows system. All investigated incidents involved communication with the same C2 IP address, 144.172.116[.]37, providing a key indicator of compromise.
Defenders are advised to focus on the sequence of events rather than individual filenames. Suspicious activity includes camera software launching an unexpected executable, followed by a Microsoft component running from a writable folder and making unusual outbound network connections. Huntress recommends organizations inventory their camera management applications, restrict access, and closely monitor network activity associated with these tools.
While the initial vector of compromise for the camera software is unknown, the immediate lesson is that surveillance system management applications require the same level of endpoint oversight as other business software. The campaign underscores the importance of scrutinizing process chains and the execution locations of executables, especially when they are found in user-writable directories.