[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fmAJhe6YxeH8lb-a--eFnrZzAJ_fR1KVoOyCS1-OLdmQ":3},{"article":4,"iocs":51,"watch_terms":60,"solutions":61,"lesson":153},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"a1f49c10-02cd-48ba-be68-4e452a6f5fa9","Hackers Compromise Camera Management Software to Deploy Malware on Windows Computers","hackers-compromise-camera-management-software-to-deploy-malware-on-windows-compu-a6c9e0","Hackers have compromised camera management software to deploy malware on Windows computers, using a legitimate Microsoft program to run malicious code and maintain access. The activity shows how software used to manage surveillance systems can become an entry point into business networks. The incidents followed a similar pattern: attackers gained access through the camera application, […] The post Hackers Compromise Camera Management Software to Deploy Malware on Windows Computers appeared first on Cyber Security News.","Attackers have compromised camera management software, using it as an entry point to deploy malware on Windows systems. The attackers leveraged DLL sideloading with a legitimate Microsoft program to establish persistence and communicate with a command-and-control server. This highlights the risks associated with trusted surveillance software becoming a vector for network compromise.","Hackers exploit camera management software to deploy malware using DLL sideloading.","https:\u002F\u002Fcybersecuritynews.com\u002Fcamera-management-software\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F10\u002FHackers-Compromise-Camera-Management-Software-to-Deploy-Malware-on-Windows-Computers.webp","2026-10-28T11:03:12+00:00","2026-10-28T12:00:26.96586+00:00",8,[17,20,23,25],{"name":18,"type":19},"Windows Parental Control Monitor","product",{"name":21,"type":22},"Microsoft","vendor",{"name":24,"type":22},"3R Global",{"name":26,"type":27},"DLL sideloading","technology","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":28,"icon":30,"name":31,"slug":32},null,"Malware","malware",[34,39,44,46],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":40},{"id":41,"icon":30,"name":42,"slug":43},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":45},{"id":28,"icon":30,"name":31,"slug":32},{"category":47},{"id":48,"icon":30,"name":49,"slug":50},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[52,56],{"type":53,"value":54,"context":55},"ip","104.21.23.104","Command-and-control IP address",{"type":57,"value":58,"context":59},"domain","3rglobal.com","Domain associated with potential vendor of affected software",[21,24,18],{"controls":62,"vendors":146},[63,91,117],{"slug":64,"name":65,"problem":66,"products":67},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[68,75,83],{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":70,"url":73,"description":74},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"slug":92,"name":93,"problem":94,"products":95},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",[96,104,112],{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"airlock-digital","Airlock Digital","\u002Fvendor-logos\u002Fairlock-digital.png","airlock-allowlisting","Airlock Allowlisting and Execution Control","https:\u002F\u002Fwww.airlockdigital.com\u002F","Blocks anything not explicitly trusted from running, with tools to build and keep the trusted list current as software changes.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","ringfencing","Ringfencing","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fringfencing","Limits what approved applications may do, such as which files, network locations and other programs they can reach, so a compromised application cannot be turned against you.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":113,"product_name":114,"url":115,"description":116},"allowlisting","Allowlisting","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fallowlisting","Blocks any software that has not been approved, including ransomware and unapproved remote-access tools. A learning period builds the approved list first.",{"slug":118,"name":119,"problem":120,"products":121},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[122,130,138],{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",[147],{"slug":148,"name":149,"logo_path":150,"roles":151},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png",[152],"reported_by",{"slug":154,"title":155,"body":156,"framework_refs":157,"framework_notes":165},"compromised-camera-software-used-to-sideload-malware-via-trusted-microsoft-binary","Compromised Camera Software Used to Sideload Malware via Trusted Microsoft Binary","Attackers weaponized legitimate camera management software as a delivery mechanism for malware, exploiting the inherent trust organizations place in surveillance tools. By abusing DLL sideloading with a genuine Microsoft executable, they bypassed application allowlisting and established persistent command-and-control communication without triggering obvious alarms. This attack illustrates how trusted third-party software can become a silent foothold when vendors are compromised or their software is tampered with. Organizations must not assume that software from reputable vendors is inherently safe, especially when it operates with elevated privileges on Windows endpoints.",[158,159,160,161,162,163,164],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 7: Continuous Vulnerability Management","MITRE ATT&CK T1574.002: DLL Side-Loading","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIS2 Article 21(2)(b)","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control",{"NIS2 Article 21(2)(b)":166,"NIST SP 800-53 SI-2: Flaw Remediation":167,"MITRE ATT&CK T1574.002: DLL Side-Loading":168,"CIS Control 7: Continuous Vulnerability Management":169,"CIS Control 2: Inventory and Control of Software Assets":170,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":171,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":172},"NIS2 mandates supply chain security measures; organizations relying on camera management software should have assessed vendor security posture to prevent this style of compromise.","Ensuring that third-party software is regularly reviewed for integrity and that compromised versions are identified and remediated falls directly under flaw remediation controls.","This technique describes exactly how attackers used a legitimate Microsoft binary to load a malicious DLL, and threat-informed defenses mapped to this TTP would have detected or blocked it.","Regular scanning for tampered or unexpected binaries within installed applications would help detect supply-chain-level modifications before malware executes.","Maintaining an authoritative inventory of approved software and their expected file compositions would have flagged the unauthorized DLL introduced by attackers.","This control requires organizations to track and respond to vulnerabilities in all software they use, including third-party surveillance tools that may be silently compromised.","Restricting what processes camera management software can execute and which network destinations it can reach would have constrained the attacker's ability to establish persistence and C2 communication."]