Hackers breach company networks via CCTV camera management software

Huntress reported a handful of incidents in September–October 2026 where attackers abused legitimate camera management software to sideload malicious DLLs and gain network access. The vendor remains unidentified, though strings point to Korean firm 3R Global. Researchers urge treating camera systems as security-sensitive assets.

• Attacks used CMS.exe with DLL sideloading and rs.win32.exe reverse shell
• Persistence added via WpcMon.exe in the user Run key
• Malicious IPHLPAPI.DLL and samcli.dll posed as zlib libraries
• Vendor unknown; possible link to Korea's 3R Global