Your security camera is still recording. The feed looks normal. The app connects fine. And yet, in the background, it might be sending traffic to a command-and-control server somewhere in Eastern Europe, helping launch a DDoS attack against a bank you’ve never heard of.
This isn’t paranoia. It’s exactly what happened to hundreds of thousands of surveillance devices in 2026 — and the question “is my camera hacked botnet” is one security teams are asking far more often this year.
The Nexcorium Wake-Up Call
In April 2026, FortiGuard Labs published research on a new Mirai-based botnet called Nexcorium, which hijacked TBK surveillance DVRs through a command injection flaw (CVE-2024-3721). TBK has more than 600,000 cameras and 50,000 recorders deployed worldwide — in banks, government buildings, and retail chains. The compromised devices kept recording footage normally. In the background, they were launching DDoS attacks, brute-forcing other devices on the network, and spreading laterally — all while the owner had no idea anything was wrong.
Nexcorium isn’t an isolated case. It’s part of a pattern security researchers have tracked for years: outdated, unbranded, or unsupported IP cameras and DVRs being recruited into Mirai-variant botnets through unpatched command injection flaws. Earlier incidents hit AVTECH and Edimax cameras the same way — both involved devices that had reached end-of-life and stopped receiving firmware updates, leaving a known flaw permanently exploitable.
The common thread across every one of these incidents: the camera still worked perfectly from the owner’s point of view. That’s exactly why this threat goes undetected for months.
6 Warning Signs Your Camera Might Be Hacked Into a Botnet
If you’re trying to figure out whether your camera is hacked or part of a botnet, these are the six signals security teams check first:
- Unusual outbound traffic — Your camera is talking to IP addresses you don’t recognize, especially at odd hours when no one is reviewing footage.
- Sluggish live view or recording lag — A camera quietly running botnet processes in the background has less CPU left for its actual job.
- Unexpected reboots — Some botnet malware forces periodic restarts to maintain persistence or avoid detection.
- Your ISP or network admin flags abnormal upload volume — DDoS participation generates outbound traffic spikes that don’t match normal camera behavior.
- You can’t recall ever changing the default password — This is the single biggest predictor of compromise. Default-credential cameras get scanned and infected within minutes of being exposed to the internet.
- The device hasn’t received a firmware update in over a year — If the manufacturer has stopped supporting the model, any newly discovered flaw stays open forever.
Why This Keeps Happening: The End-of-Life Problem
Botnet operators don’t need a zero-day. They reuse old, well-documented vulnerabilities because so many devices never get patched. A flaw disclosed years ago can still infect new victims today simply because the camera model was discontinued and nobody pushed a fix.
This is the core difference between consumer-grade, white-label surveillance hardware and enterprise-grade brands that maintain active security programs. Axis Communications operates with a Security Development Lifecycle framework, meaning security is built into every stage of product design, with firmware built on a hardened Linux kernel and regularly audited by third parties. Axis also provides signed firmware updates with SHA-256 hashing specifically to prevent tampering — the kind of protection that makes a Nexcorium-style hijack far harder to pull off.
If you want a deeper brand-by-brand breakdown, we’ve already covered this in detail in our Hikvision vs Axis Security Cameras: Which Is Safer in 2026? comparison.
How to Check and Fix a Hacked Security Camera Right Now
- Check your router’s connected devices list. Look for unusual outbound connections from your camera or DVR’s IP address.
- Log into the camera and change the default password immediately if you haven’t already — this single step closes the door that most botnets use to get in.
- Check the manufacturer’s firmware page for your exact model. If there’s been no update in 12+ months, treat it as a liability, not a tool.
- Isolate the camera on its own VLAN. Even if it’s compromised, segmentation stops it from pivoting into the rest of your network. Our guide on Zero Trust Network Security covers exactly how to set this up.
- If the device is end-of-life, replace it. No amount of password-changing fixes a vulnerability the manufacturer will never patch.
The Real Fix: Stop Buying Cameras That Get Abandoned
The businesses that keep showing up in botnet research aren’t the ones using actively maintained enterprise hardware — they’re the ones running five-year-old DVRs from brands that stopped issuing firmware the moment a newer model launched.
If your current camera setup is on that list, now is the time to upgrade — not after an incident.
- Browse Hikvision IP Cameras — current-generation models with active firmware support and AI-powered detection.
- Browse Axis Communications Cameras — enterprise-grade hardware with signed firmware and a published vulnerability disclosure program.
- Pair your camera network with a business firewall to segment IoT traffic from your core network and block botnet command-and-control connections at the perimeter.
Frequently Asked Questions
Can a security camera be hacked even if I never set up remote viewing?
Yes. If the camera is connected to the internet at all — even just for local network access through a router with UPnP enabled — it can be scanned and targeted by botnet malware without you ever opening a remote viewing app.
Does changing the password fix an already-infected camera?
Not always. If malware is already running in memory, a password change blocks new infections but won’t remove an active infection. A factory reset followed by a firmware update and password change is the safer fix.
Are Hikvision cameras safe to use in 2026?
Current-generation, properly licensed Hikvision models that receive regular firmware updates are significantly safer than legacy or gray-market units. See our full Hikvision vs Axis comparison for the complete picture.
What’s the single biggest thing I can do today?
Change every default password on every camera and DVR on your network. It takes five minutes and closes the most commonly exploited door.
