They went to some amount of effort to hide it.
On a Hikvision one I pulled apart recently it was literally a binary running as root called `backdoorServer`.
On a Hikvision one I pulled apart recently it was literally a binary running as root called `backdoorServer`.