Hackers Exploit Camera Management Software to Enter Company Networks

Security researchers say attackers have used camera management software to gain initial access to company systems. Huntress researchers Harlan Carvey and Lindsey O'Donnell-Welch observed a “handful of incidents” in September and October 2026. They could not identify the targeted software or determine how many victims were affected.

In each incident, attackers abused a legitimate camera management system to side-load a malicious DLL and access the underlying system. Huntress said it could not confirm who made the software. Strings in an executable suggested a possible link to South Korean company 3R Global, but researchers could not establish that it came from the company’s website.

After gaining access, attackers reportedly launched a reverse shell using rs.win32.exe, with a command line that included a remote IP address, port and administrator username. They then used the legitimate Windows file WpcMon.exe to load malicious DLLs named IPHLPAPI.DLL and samcli.dll. The files appeared to be zlib compression libraries but had been modified to contact an external command-and-control server.

Huntress said the attackers also added WpcMon.exe to a user’s Run registry key so it would launch at sign-in. The researchers urged defenders to inventory camera software, restrict its access and monitor unusual processes and outbound connections. They also recommended application controls to block unapproved executables and DLLs in user-writable paths.