Hackers Are Infiltrating Corporate Networks via Security Camera Software

In modern offices and industrial facilities, security cameras and their management systems are often viewed as secondary infrastructure. However, recent data indicates these devices are becoming a primary gateway for hackers to infiltrate corporate networks. Cybersecurity researchers have uncovered a new wave of attacks exploiting vulnerabilities within surveillance Content Management System (CMS) software.## How the Scheme WorksThe attack process is highly sophisticated and designed to bypass standard security measures. Hackers employ a technique known as DLL sideloading. In this scenario, attackers place malicious code into a system, which is then automatically executed by legitimate software. Specifically, attackers use a genuine Microsoft file, WpcMon.exe (Windows Parental Control Monitor), to load malicious DLL libraries. Consequently, antivirus systems often fail to detect the threat because the process appears to be running under a legitimate file name.Once hackers establish a foothold, they connect to an external Command and Control (C2) server to create a "reverse shell." This grants them remote control over the company's network, allowing them to exfiltrate data or establish persistent access. Attackers also modify the Windows Registry to ensure their malware runs automatically every time the system boots.## Challenges in IdentificationThe most concerning aspect for researchers is the inability to determine the exact scale of these attacks. The surveillance software exploited by hackers lacks version descriptions or manufacturer information. While there is speculation that the software may be linked to the Korean company 3R Global, this remains unconfirmed.Because the precise identity of the software is unknown, it is impossible to gauge how many companies are infected. This uncertainty complicates defensive efforts. Experts warn that the small number of currently identified incidents is likely just the tip of the iceberg, and the threat may be far more widespread.## Recommendations for BusinessesSecurity experts urge companies to stop viewing camera management systems as isolated devices. Instead, they should be treated as critical network nodes that require robust protection.Recommended steps include:- Conducting a strict inventory of camera management software and restricting access.- Monitoring network traffic to detect unusual connections.- Implementing application control mechanisms to prevent the execution of unauthorized files and DLLs.- Actively auditing system logs for suspicious files such as rs.win32.exe or non-standard usage of WpcMon.exe.For businesses, including those in Georgia that actively use a variety of surveillance systems, these threats are very real. It is essential for IT administrators to critically evaluate their existing security policies and ensure that their surveillance systems do not become a source of vulnerability.