Hackers exploit CCTV software vulnerabilities for network access via DLL sideloading

How the attack unfolds

According to TechRadar, hackers abused a legitimate camera management system to side-load malicious DLL files, gaining access to the underlying system. The attack chain began with an executable (rs.win32.exe) tied to unspecified CCTV software, which Huntress researchers could not fully attribute to a vendor or creator.

The attackers used DLL sideloading to load two malicious DLLs—IPHLPAPI.DLL and samcli.dll—via a legitimate Microsoft Windows process, WpcMon.exe. Once executed, these DLLs established beaconing to external command-and-control (C2) servers, enabling further exploitation.

To maintain persistence, the attackers modified the victim’s Run registry key, ensuring their payload launched automatically during user logins. Huntress researcher Harlan Carvey noted that this technique is a common tactic for threat actors to sustain access without relying on repeated phishing or exploit attempts.

Unanswered questions

The exact scope of the campaign remains unclear. Huntress analysts could not determine the full name or vendor of the targeted camera management software, nor confirm the number of victims. This lack of visibility complicates efforts to assess the attack’s reach or prioritize defenses for specific systems.

A Korean company, 3R Global, surfaced as a potential lead after researchers found strings referencing it in the executable. However, Huntress could not confirm whether the executable was downloaded from 3R Global’s website or if the company is directly involved. The ambiguity highlights the challenges of tracking supply-chain risks in niche software markets.

Why this matters for operators

This campaign aligns with a broader trend Lazyfounder has reported: attackers increasingly target non-traditional entry points, such as IoT and OT systems, which often receive less security scrutiny than standard IT infrastructure. Microsoft’s recent warning about AI-driven cyber threats—particularly in regions like the UK—further underscores the shifting threat landscape, where even legacy or niche software can become a vector for sophisticated attacks.

The use of DLL sideloading also reflects a tactic that evades signature-based detection. Founders and operators should note that legitimate processes (like WpcMon.exe) can be co-opted to load malicious code, making behavioral analysis and registry monitoring critical for early detection.

What this means

Lazyfounder analysis — our interpretation, not reported fact.

This campaign reveals a critical blind spot for operators: CCTV and camera management systems are now active vectors for network intrusion. Unlike traditional IT assets, these systems are often deployed without the same level of security scrutiny, making them attractive entry points for attackers. For founders, this underscores the need to extend threat modeling to include operational technology (OT) and Internet of Things (IoT) devices—especially if they rely on third-party software for monitoring or management. The use of DLL sideloading also highlights how attackers exploit trust in legitimate processes, a tactic that evades conventional endpoint protection. Companies should prioritize behavioral monitoring and registry-level audits to detect similar threats.

Key takeaways

• CCTV and camera management software are emerging as high-risk vectors for initial network access, requiring the same security scrutiny as traditional IT systems.
• DLL sideloading remains a stealthy tactic; founders should audit software dependencies and monitor for unusual DLL loads.
• Registry modifications for persistence are a red flag; automated registry monitoring can help detect such intrusions early.
• Unmanaged or third-party software—even in niche categories like CCTV—can expose networks to undetected threats.

Related on Lazyfounder

• Microsoft warns AI cyber threats are now mainstream, UK most targeted in Europe
• More technology news