Camera management software is being exploited by threat actors to gain initial network access and establish persistence, as first reported by Tech Radar.
Security researchers at Huntress identified a campaign during September and October 2026 involving the abuse of camera management systems. Attackers utilized these platforms to perform dynamic link library (DLL) sideloading, allowing them to execute malicious code while evading traditional security detection. By leveraging legitimate software, the threat actors deployed reverse shells and established persistence by modifying Windows registry keys to ensure their payloads launched upon user login. Although the specific software vendor remains unconfirmed, evidence suggests potential ties to 3R Global. The attackers utilized a legitimate Microsoft Windows Parental Control Monitor file to load weaponized DLLs, which facilitated beaconing to external command-and-control servers. This technique highlights the risks associated with treating peripheral management tools as low-security assets. Experts urge organizations to inventory all camera management software, restrict network access and implement application control to prevent the execution of unauthorized files. Monitoring for abnormal outbound connections and unusual process sequences is essential to mitigating these threats within enterprise environments.
Source: Tech Radar
