Operation CameraSwarm: 14,500 Dahua Cameras Compromised Across Ukraine and Russia
Do Son 
At a Glance
| Actor | A single unattributed operator (Russian-language code comments observed) |
| Activity | Mass compromise of Dahua IP cameras via brute-force, auth-bypass, and P2P relay abuse |
| Targets | Internet-exposed Dahua and OEM-rebranded cameras; compromises concentrated in Ukraine and Russia |
| Scale | 14,530+ devices in 35 days; 1,923 backdoored; 283 reached by serial alone |
| Status | National CERTs notified 10 August 2026; Dahua PSIRT engaged; no charges announced |
| Source | Hunt.io AttackCapture research |
TL;DR
A single operator compromised more than 14,500 Dahua IP cameras in 35 days. Hunt.io reconstructed the camera hacking campaign after the operator exposed their own working directory. Operation CameraSwarm hit devices mostly in Ukraine and Russia, using three attack paths at once.
What Happened
Between 17 June and 22 July 2026, one operator ran a mass camera hacking campaign. Hunt.io researchers found the operation by accident. The operator left an HTTP server open, exposing their entire toolkit.
On 23 July, Hunt.io’s AttackCapture crawled that host. It recovered 2,616 files across 234 subdirectories, 407 MB in total. The corpus held source code, logs, credentials, camera snapshots, and shell history. That haul let the team map the whole operation.
The campaign ran three exploitation paths in parallel. A brute-force engine hit port 37777 across 12,324 unique addresses. An auth-bypass chain backdoored survivors. A cloud relay path reached cameras by serial number alone.
How the Attacks Worked
The three paths shared one goal: reach as many cameras as possible. Each solved a different access problem.
Credential Brute-Force
The engine guessed camera passwords at scale. It used an asyncio framework tuned for internet-wide lists. Across twelve productive runs, Hunt.io estimates roughly 13,000 device credentials were recovered, a figure the report presents as an estimate.
Two Authentication Bypasses
A Go tool called p2pwn chained two real flaws, CVE-2021-33044 and CVE-2021-33045. Neither needs a valid password. After either bypass, the tool installed a hidden account. Per Hunt.io, that account “survives a password change and, on most firmware, a factory reset.”
P2P Relay Abuse
The third path was the most striking. It reached cameras behind NAT using only a serial number. The operator’s own code records that “89.4 percent of live serials required no authentication.” In plain terms, most exposed devices demanded no password at all.
Who Is Behind It
Attribution stays limited, and the report is careful about it. The operator is not named or charged. Russian-language comments run through the modified code, and campaign folders carry Ukrainian and Russian tags.
The toolkit is assembled from other people’s work. Hunt.io credits at least six upstream developers and stresses one point: “Running these tools establishes use, not authorship.” A leaked Windows username appeared in one test log, but Hunt.io does not tie it to a real identity.
A Careful Word on the CVEs
Two CVE labels in the toolkit do not hold up. CVE-2024-39943 and CVE-2025-31702 are misapplied to techniques they do not describe. The methods work, but the identifiers are wrong. Independent reporting from BleepingComputer echoes this point.
Impact and Scale
The numbers are large. The campaign compromised 14,530+ devices in 35 days. It planted a persistent backdoor on 1,923 cameras. It reached 283 more by serial number alone.
A second, unrelated tool sat on the same host. Hunt.io found a Windows stealer, tagged as SalatStealer, staged with a Defender-bypass script. The team treats it as a separate incident, not part of the camera hacking campaign.
How to Stay Protected
Camera owners can cut this risk sharply. Patch Dahua firmware to close the two bypass flaws. Change default and weak passwords right away.
Where possible, disable cloud P2P access on exposed devices. Put cameras behind a firewall or VPN, not on the open internet. Defenders should also check for the backdoor account and unexpected admin resets.
Support Our Threat Intelligence
Find our zero-day alerts and CVE reports helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
PayPal
