Operation CameraSwarm: Dahua Cameras Compromised

Threat intelligence firm Hunt.io has uncovered a massive 35-day campaign that compromised more than 14,500 Dahua IP cameras across Ukraine and Russia. The operation, dubbed Operation CameraSwarm, exploited credential attacks, authentication bypass flaws, and a peer-to-peer relay technique to hijack devices at an industrial scale.

Researchers recovered the operator’s entire toolkit from an exposed HTTP server. Consequently, the discovery reveals how a single attacker can weaponize old vulnerabilities and cloud-relay features to build a persistent surveillance network.

What Happened: CameraSwarm Compromises 14,530 Dahua Cameras in 35 Days

Between June 17 and July 22, 2026, a single operator compromised 14,530 Dahua IP cameras. The brute-force engine alone reached 12,324 unique IP addresses. Furthermore, 1,923 cameras were configured with a persistent backdoor account, and 283 devices were reached through a peer-to-peer relay using only their serial numbers.

Hunt.io discovered the campaign on July 23, 2026, when its AttackCapture system crawled an open HTTP directory on the operator’s server. The researchers recovered 407 MB of data across 2,616 files in 234 subdirectories. Moreover, the exposed working directory contained source code, logs, credentials, captured camera snapshots, shell history, and exploitation results.

The operator is assessed as Russian-speaking based on language artifacts in modified code. However, the activity has not been attributed to a named threat actor or government entity. Hunt.io noted with moderate confidence that parts of the toolkit appeared designed to transfer camera access to a third party.

Technical Details of the CameraSwarm Attack

CameraSwarm employed three attack paths in parallel. Each path targeted a different weakness in Dahua’s ecosystem, from exposed management ports to cloud-relay infrastructure.

Path 1: Credential Brute-Force on TCP Port 37777

The operator used an asyncio-based brute-force engine to scan TCP port 37777, Dahua’s Easy4IP management protocol. The engine targeted 12,324 unique IP addresses across 13,229 campaign records. In addition, the scanning infrastructure used masscan sweeps at up to 10 million packets per second, first against Russian address space and then across the full IPv4 range.

A companion module filtered targets by local time of day. Therefore, CIDR blocks were skipped unless local time fell within 09:00 to 16:59, suggesting the operator prioritized cameras likely to be active during business hours.

Path 2: Authentication Bypass via CVE-2021-33044 and CVE-2021-33045

The operator exploited two authentication-bypass vulnerabilities in Dahua cameras using a tool called p2pwn. These flaws, disclosed in 2021, remain listed in CISA’s Known Exploited Vulnerabilities catalog as of August 2026.

• CVE-2021-33044: Attackers bypass device identity authentication by constructing malicious data packets. A NetKeyboard client type triggers the flaw during authentication.
• CVE-2021-33045: A loopback login request using the 127.0.0.1 address bypasses authentication checks.

The p2pwn tool installed a persistent backdoor account (p2pwn / p2password) on 1,923 cameras. This account is stored independently of the admin password. Moreover, on most firmware versions, it survives both password changes and factory resets.

Path 3: P2P Relay Exploitation via Serial Number

The most concerning path required no credentials and no routable IP address. The operator used Dahua’s Easy4IP cloud relay to reach cameras behind NAT using only their serial numbers.

ITRES Labs previously identified this exposure in October 2025. The P2P protocol locates a device through Easy4IPCloud using its serial number and establishes a tunnel to the camera. On firmware released before mid-2024, the relay established the route before the device performed its own credential check. Consequently, 89.4 percent of live serial numbers tested by the operator returned an open channel without authentication.

The toolkit also generated offline recovery codes from serial numbers. These codes grant cloud-level administrative access independently of device credentials. Furthermore, removing the backdoor account does not invalidate recovery codes generated by the toolkit. They remain usable until Dahua alters the derivation server-side.

Business and Operational Impact

Operation CameraSwarm demonstrates how IoT vulnerabilities can be weaponized for mass surveillance and infrastructure compromise. The impact extends across multiple domains.

• Physical surveillance: Compromised cameras in government buildings, critical infrastructure, and private facilities provide real-time video feeds to unauthorized operators.
• Reconnaissance: Camera snapshots and feeds enable threat actors to map facilities, identify security gaps, and plan physical intrusions.
• Network pivoting: Cameras on internal networks can serve as beachheads for lateral movement into enterprise environments.
• Data exposure: Captured images, credentials, and device metadata were stored in the operator’s working directory, creating a persistent intelligence archive.
• Third-party access: The transferable-access design suggests the toolkit was built to hand camera access to external buyers or collaborators.

The geographic concentration in Ukraine and Russia carries geopolitical significance. Ukrainian runs held the largest share of results, with the DH-IPC-K35P as the most frequently compromised model. Therefore, defenders in Eastern Europe should treat this as a targeted threat to national security infrastructure.

Mitigation and Recommendations

Defenders should act immediately to identify and remediate potentially compromised Dahua devices.

Immediate Actions for Defenders

1. Inspect devices for the p2pwn backdoor account. Check administrative user lists for an account named p2pwn and remove it if present.
2. Disable P2P connectivity. Turn off Easy4IP and P2P features unless explicitly required for operations.
3. Apply Dahua SA-2021-0130 firmware updates. Install patched firmware for CVE-2021-33044 and CVE-2021-33045, or upgrade to a later firmware version.
4. Restrict Easy4IP connectivity. Limit cloud-relay access to trusted networks and monitor for unauthorized serial-number lookups.
5. Use strong, unique credentials. Change default passwords and enforce complex passwords on all camera accounts.
6. Remove unused accounts. Audit and delete any accounts not required for day-to-day operations.
7. Segment video surveillance systems. Isolate cameras on dedicated network segments with restricted outbound access.
8. Monitor TCP port 37777. Detect and block unauthorized scanning or brute-force attempts against Dahua management ports.

Long-Term Considerations

Dahua camera owners should treat any device reachable on port 37777 between June and July 2026 as potentially compromised. Furthermore, organizations should evaluate whether cloud-relay features in IoT devices introduce unacceptable risk. The CameraSwarm campaign proves that serial-number-based access can bypass traditional network security controls entirely.

Bottom line: Operation CameraSwarm is a stark reminder that old vulnerabilities in IoT devices do not age out of relevance. CVE-2021-33044 and CVE-2021-33045 have been public for five years, yet they enabled a 14,500-device compromise in 2026. Organizations must patch aggressively, disable unnecessary cloud features, and treat every internet-connected camera as a potential surveillance liability.

Incident Summary

Incident Name:	Operation CameraSwarm
Affected Systems:	Dahua IP cameras (DH-IPC-K35P most frequent), Easy4IP-enabled devices
Disclosure Date:	August 18, 2026 (Hunt.io publication)
Campaign Period:	June 17 – July 22, 2026
Total Compromised:	14,530+ devices
CVEs Exploited:	CVE-2021-33044, CVE-2021-33045 (CISA KEV-listed)
Backdoor Account:	p2pwn / p2password (survives factory reset on most firmware)
Geographic Focus:	Ukraine and Russia (concentrated), global scanning
Patch Status:	Dahua SA-2021-0130 firmware available; P2P relay reinforced in firmware after mid-2024
Threat Actor:	Unnamed Russian-speaking operator; unaffiliated with known groups

References

1. Hunt.io, “Operation CameraSwarm: Over 14,000 Dahua cameras compromised across Ukraine and Russia,” August 18, 2026, https://hunt.io/blog/operation-cameraswarm-dahua-cameras-compromised.
2. BleepingComputer, “Hackers compromise 14,500 Dahua web cameras in 35-day campaign,” August 19, 2026, https://www.bleepingcomputer.com/news/security/hackers-compromise-14-500-dahua-web-cameras-in-35-day-campaign/.
3. The Hacker News, “Hackers Compromised 14,500+ Dahua Devices Using Credential Attacks, Auth Bypasses, and P2P,” August 19, 2026, https://thehackernews.com/2026/08/hackers-compromised-14500-dahua-devices.html.
4. ITRES Labs, “Dahua: Beyond CVE-2025-31702 – P2P Relay Exposure,” October 29, 2025, https://labs.itresit.es/2025/10/29/dahua-beyond-cve-2025-31702-p2p-relay-exposure/.
5. CISA, “Known Exploited Vulnerabilities Catalog,” https://www.cisa.gov/known-exploited-vulnerabilities-catalog, accessed August 20, 2026.
6. Dahua Technology, “Security Advisory – Identity Authentication Bypass Vulnerability,” SA-2021-0130, https://www.dahuasecurity.com/about-dahua/trust-center/dahua-psirt/dhcc-sa-202106-001.