Loading story…
Researchers reconstructed Operation CameraSwarm, a 35-day campaign that compromised more than 14,530 Dahua IP cameras, with the largest concentration of affected devices in Ukraine and Russia. The operation was pieced together from an exposed directory on 154.86.119.60 containing the operator’s tooling, logs, source code, and staging files. According to the report, the attackers used three parallel access paths: credential brute forcing on TCP/37777, exploitation of CVE-2021-33044 and CVE-2021-33045, and abuse of Dahua’s P2P cloud relay to reach cameras by serial number. Researchers said the relay path relied on cloud-issued session tokens obtainable through fixed SDK credentials embedded in Dahua clients, enabling unauthenticated access through that channel.
The operators also installed a persistent backdoor account, p2pwn / p2password, on 1,923 cameras; the account reportedly survives password changes and, on most firmware, even factory resets, while offline-generated recovery codes could provide additional cloud-level administrative reset capability by serial number. Hunt.io said some CVE labels used in the tooling were incorrect, including a misreference to CVE-2024-39943 and an overbroad use of CVE-2025-31702, and it made no attribution claim for the campaign. The same host also staged a separate UPX-packed Windows payload believed to be SalatStealer and a PowerShell script for Microsoft Defender exclusions. Defenders were urged to treat exposed Dahua cameras as potentially compromised, remove the p2pwn account, rotate credentials, disable P2P where unnecessary, and apply firmware updates covered by Dahua SA-2021-0130.
See affected versions and whether adversaries are exploiting it.
8 events from the most recent confirmed update back to the earliest known activity.
On 18 August 2026, Hunt.io published a technical analysis of Operation CameraSwarm, detailing how a single operator compromised more than 14,530 Dahua cameras between 17 June and 22 July 2026. The report publicly documented the brute-force, exploit-chain, and cloud-relay access paths, as well as tooling and infrastructure including host 154.86.119.60 and a second host at 185.132.53.56.
On August 10, 2026, Hunt.io notified national CERTs and Dahua's PSIRT about the CameraSwarm campaign. This was an official disclosure and coordination step following Hunt.io's reconstruction of the operation.
On 23 July 2026, Hunt.io AttackCapture crawled an exposed open HTTP directory on 154.86.119.60 used by the operator. The crawl recovered 2,616 files across 234 subdirectories totaling 407 MB, enabling reconstruction of the campaign.
On 18 June 2026, the campaign's largest early haul skewed toward Mexican and Vietnamese consumer ISP ranges before later focus shifted toward Russian and CIS telecom netblocks. The broader compromise set was later concentrated in Ukraine and Russia, with Ukraine holding the largest share.
Between 17 June and 22 July 2026, a single operator compromised more than 14,530 Dahua IP cameras over 35 days. The campaign used credential brute forcing on TCP/37777, exploitation of CVE-2021-33044 and CVE-2021-33045, and abuse of Dahua's P2P relay by serial number.
Hunt.io reported that the CameraSwarm operator used Dahua's cloud relay to reach 283 cameras by serial number alone during the campaign. The recovered tooling logged that 89.4% of live serials exposed an open no-authentication channel, making serial-number knowledge the main barrier to access.
During the campaign, the operator installed a persistent backdoor account named p2pwn with password p2password on 1,923 cameras. The account was installed over RPC and survived password changes and, on most firmware, factory resets.
SSH fingerprint telemetry showed that server 154.86.119.60 had hosted multiple operating system generations since April 2025, indicating the infrastructure predated the camera-compromise campaign. Hunt.io assessed the host was repurposed rather than provisioned specifically for this operation.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 18 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
12 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcesecurityweek.com
Open sourcexakep.ru
Open sourcecyberveille.ch
Open sourcereddit.com
Open sourcehunt.io
Open sourcegithub.com
Open sourcelabs.itresit.es
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers at Hunt.io uncovered two exposed directories that revealed parallel intrusion operations targeting internet-exposed infrastructure in Ukraine, particularly IP cameras and routers. One server at `89.208.97[.]165` contained evidence that a Ukrainian OpenCart-based e-commerce site had been compromised through SQL injection and repurposed as a proxy and staging node for Tor-routed intrusion attempts against Ukrainian government and military websites. The same server hosted a custom camera exploitation platform, **camview**, whose recovered data showed 58 compromised Ukrainian cameras, logs of live viewing sessions, and use of the open-source **Ingram** scanner against Dahua, Hikvision, D-Link, and Reolink devices. A second exposed directory at `213.165.63[.]49` showed a separate but similar operation using Russian-language tooling, **Ingram**, and custom scripts to scan and exploit routers and cameras across 15 European countries, with camera targeting concentrated on Ukraine. The toolkit focused on converting compromised TP-Link, MikroTik, and camera devices into **SOCKS5 proxies** and reverse tunnels over port `4444`, relying on stolen access, weak credentials, and known vulnerabilities, including `CVE-2021-33044`. Hunt.io said the activity was not attributed to a named threat actor or state entity, but the exposed infrastructure pointed to a low-cost, repeatable campaign aimed at Ukrainian targets using publicly available tools and long-patched flaws.
Aug 13, 2026
Dahua published advisory `DHCC-SA-202606-001` covering three vulnerabilities in IP cameras, PTZ cameras, network video recorders, and related hardware. The most serious issue, `CVE-2026-29114`, exposes a device CA root certificate, creating a risk of fraudulent certificate issuance where clients trust that CA. Two additional flaws enable denial of service: `CVE-2026-29115` lets an authenticated remote attacker crash affected systems, while `CVE-2026-29116` allows an unauthenticated attacker to send a specially crafted packet that triggers an exception and forces an unexpected reboot.
Jun 29, 2026
Bitdefender disclosed two serious vulnerabilities in Dahua camera firmware, tracked as **CVE-2025-31700** and **CVE-2025-31701**, that can be exploited by an unauthenticated attacker to achieve remote code execution or trigger denial of service. The flaws affect the **Dahua Hero C1 Smart Camera** and multiple Dahua **IPC, SD, and TPC** camera series, with all firmware released before `2025-04-16` reported as vulnerable. Both vulnerabilities carry a **CVSS 3.1 score of 8.1**, and CSIRT.SK warned that successful exploitation could compromise device integrity and the security of monitored premises. Administrators and camera owners were urged to apply Dahua’s available firmware updates promptly to reduce the risk of takeover or service disruption across exposed surveillance deployments.
Jul 24, 2026