Hackers are breaking into company networks via hacked CCTV camera software

Security researchers have raised concerns about an ongoing campaign targeting camera management software vulnerabilities. Huntress, a security outfit, discovered that attackers have been exploiting legitimate camera management systems to gain initial access and establish persistence on company networks. The attackers used a technique known as DLL sideloading, where they injected malicious DLL files into a legitimate application, in this case, a camera management system.

This allowed them to evade detection and maintain control over the compromised network. The researchers were unable to determine the exact software being targeted or the number of victims, but they noted that the attackers created persistence by adding a reference to the malicious WpcMon.exe file in the user's Run registry key. This enabled the threat actors to launch the malicious file whenever the user signed in.

By disguising the malicious DLL files as legitimate ones, such as Microsoft Windows Parental Control Monitor, the attackers made it more difficult for security software to detect the malicious activity. Huntress advises organizations to treat camera systems as security-sensitive assets and monitor them for abnormal activity. This includes inventorying the software, restricting its access, and monitoring for unusual processes and outbound connections.

Additionally, they recommend using application control to prevent unapproved executables and DLLs from running in user-writeable paths.