Key Takeaways
- Operation CameraSwarm compromised > 14,500 Dahua devices (June 17 – July 22 2026) via credential attacks, two 2021 authentication‑bypass flaws, and a P2P relay technique.
- The attack was reconstructed from a 407 MB exposed working directory containing tools, logs, and campaign records; most victims were in Ukraine and Russia.
- Credential guessing accounted for ≈ 12,300 unique IPs; the authentication‑bypass path hit 1,923 cameras, each configured with a persistent back‑door account.
- The P2P relay exposed 283 devices by using Dahua serial numbers to query Easy4IPCloud and open unauthenticated tunnels before the device’s own credential check.
- ITRES Labs confirmed the pre‑mid‑2024 P2P flaw, noted a post‑mid‑2024 token‑based fix, and could not independently reproduce the operator’s claim that 89.4 % of serial numbers yielded open channels.
- Defenders should disable P2P/Easy4IP when unnecessary, apply the latest Dahua firmware, replace default credentials, remove unused accounts, and segment surveillance traffic.
Overview of Operation CameraSwarm
Cybersecurity researchers at Hunt.io disclosed a campaign, dubbed Operation CameraSwarm, that compromised more than 14,530 Dahua devices between June 17 and July 22 2026. The activity was reconstructed from a 407 MB exposed working directory containing 2,616 files across 234 subdirectories, which included tooling, logs, shell history, and campaign records. The majority of confirmed compromises were located in Ukraine and Russia. Hunt.io attributed the total to three distinct attack paths: credential‑based guessing, exploitation of two authentication‑bypass vulnerabilities, and a peer‑to‑peer (P2P) relay technique that leveraged Dahua’s Easy4IP infrastructure.
Evidence Repository and Data
The exposed directory served as a forensic snapshot of the operator’s workflow. It held custom credential‑spraying scripts, PoC exploits for CVE‑2021‑33044 and CVE‑2021‑33045, and a tweaked p2pwn tool that took Dahua serial numbers as input. Shell logs showed the attacker scanning IP ranges, noting successful logins, and marking devices that got a persistent back‑door account. Campaign logs recorded 13,229 credential attempts and 1,923 authentication‑bypass successes. A dh‑p2p PoC showed how a serial number could query Easy4IPCloud and open a relay tunnel before the device’s own credential check.
Credential‑Based Compromise
Credential attacks formed the bulk of the intrusion, accounting for 12,324 unique IP addresses across the 13,229 campaign records. The operator likely used default credentials, common passwords, and leaked credential lists to brute‑force Dahua web interfaces and RTSP streams. Each successful login enabled Telnet/SSH access, allowed upload of a persistent user account, and maintained foothold after reboot. Because many Dahua devices ship with admin/admin or root/root combinations, a large portion of the exposed surface was quickly enumerated. Hunt.io stressed that this path relied solely on weak or default authentication, with no software vulnerability involved.
Authentication‑Bypass Exploits
The second vector leveraged two 2021 authentication‑bypass flaws: CVE‑2021‑33044 and CVE‑2021‑33045. Dahua rates each at CVSS 8.1, while the U.S. NVD scores them at 9.8. CVE‑2021‑33044 triggers when a NetKeyboard client type sends a malicious packet during authentication, letting the attacker bypass identity checks. CVE‑2021‑33045 abuses a loopback login to 127.0.0.1, forcing the device to accept the request as legitimate. In Operation CameraSwarm, 1,923 cameras were reached via these flaws, and each was additionally configured with the persistent account from the credential path, ensuring continued access even if the original password changed.
Peer‑to‑Peer Relay Compromise
The third vector used Dahua’s P2P relay mechanism. By feeding a device’s serial number into the Easy4IPCloud service, the attacker could create a tunnel that made the camera reachable from the internet, even when behind a NAT router. Hunt.io identified 283 distinct devices compromised via this route, identified by serial number in the recovered tooling. The P2P path does not require prior authentication; the relay opens a channel before the device performs its own credential check. However, once the tunnel is established, the device still expects valid credentials for privileged actions, prompting the attacker to pair the P2P foothold with the persistent account or credential spraying to gain full control.
How the P2P Relay Works
ITRES Labs examined the Dahua P2P protocol and found that, on pre‑mid‑2024 firmware, a valid serial number could query Easy4IPCloud and obtain a relay address without authentication. The dh‑p2p PoC shows the protocol locates the device via Easy4IPCloud, sets up a UDP/TCP tunnel, and forwards traffic to the camera’s internal IP. After mid‑2024 Dahua added a token‑based check, mitigating the unauthenticated serial‑number lookup. Hunt.io’s recovered code claimed 89.4 % of live serial numbers returned an open channel without authentication, a figure from the operator’s logs not independently reproduced by ITRES Labs, Dahua, or any public CERT advisory as of August 19 2026.
Additional Findings and Defensive Guidance
Beyond the two 2021 flaws, the toolkit contained unrelated CVEs: CVE‑2024‑39943, an OS command‑injection in Rejetto HFS, and CVE‑2025‑31702, a Dahua‑specific privilege‑escalation that requires prior normal‑user credentials. ITRES Labs classified the serial‑number relay exposure as a non‑CVE issue, noting that the vulnerability resides in the vendor’s P2P infrastructure rather than the camera firmware. Defenders should disable P2P/Easy4IP when not needed, restrict outbound connectivity to Easy4IPCloud servers, apply the latest firmware from Dahua’s website, replace default credentials with strong unique passwords, remove any unused or back‑door accounts, and segment video‑surveillance traffic onto isolated VLANs or firewalled zones.
Attribution and Current Status
Linguistic artifacts in the recovered working directory—Russian‑language comments, timestamps, and file names—led Hunt.io to assess with moderate confidence that the operator is Russian‑speaking. However, the researchers stopped short of attributing the campaign to a named threat actor, a Russian government entity, or any known cyber‑criminal group. The toolkit hinted that some components might exfiltrate camera streams to a third party, suggesting a possible resale or espionage motive. As of August 19 2026, the public p2pwn repository remains online and accepts Dahua serial numbers, confirming the underlying serial‑number P2P mechanism, but does not independently verify Hunt.io’s counts of 14,530 compromised devices, 1,923 persistent accounts, or 283 P2P compromises.
Recommendations and Outlook
Users of Dahua IP cameras, NVRs, and related products should immediately consult Dahua’s security advisory for the firmware versions that patch CVE‑2021‑33044, CVE‑2021‑33045, and the post‑mid‑2024 P2P hardening. Applying the vendor‑provided repair software or upgrading to the latest firmware mitigates both the authentication‑bypass and the unauthenticated serial‑number relay. Network administrators should also disable P2P/Easy4IP unless required, monitor for anomalous outbound connections to Easy4IPCloud endpoints, enforce multi‑factor authentication where possible, and conduct regular audits of account configurations. Until broader industry adoption of secure‑by‑design P2P protocols occurs, devices relying on vendor‑managed relay services remain susceptible to similar serial‑number‑based abuse, underscoring the need for defense‑in‑depth strategies that combine firmware hygiene, credential management, and network segmentation.