Operation CameraSwarm: 14,000 Dahua IP Cameras Hacked in Ukraine & Russia

A threat actor has compromised more than 14,000 Dahua IP cameras across Ukraine and Russia in a 35-day campaign dubbed Operation CameraSwarm, according to threat intelligence researchers at Hunt.io. The activity, which ran from June 17 to July 22, initially involved wide-scale scanning across Russian, Mexican, and Vietnamese ISP ranges before narrowing its focus to Russian and CIS telecom netblocks. By infiltrating the actor's own infrastructure, Hunt.io recovered 2,616 files across 234 subdirectories—roughly 407 MB of data—left exposed in an open HTTP directory, confirming the compromise of 14,530 devices.

The attackers relied on a combination of brute-force credential attacks and authentication bypass exploits. A brute-force engine built on a publicly available asyncio framework targeted 12,324 unique addresses, while a compiled Go binary chained three Dahua vulnerabilities—CVE-2021-33044, CVE-2021-33045, and CVE-2024-39943—to deploy a persistent backdoor account named p2pwn/p2password via Remote Procedure Call (RPC). According to Hunt.io, this account is stored independently of the admin password and survives both password changes and, on most firmware versions, factory resets. Organizations concerned about exposed credentials can run a password checker to evaluate the strength of their own device logins, while a port scanner can help identify exposed camera management interfaces on public networks.

The chained exploits are particularly damaging. CVE-2021-33044 exploits unconditional trust in clients identifying as NetKeyboard hardware controllers, bypassing password evaluation entirely. CVE-2021-33045 tricks the firmware into reading the claimed source address from the request body rather than the TCP connection, enabling an unauthenticated full-administrator session. In some cases, the operators abused Dahua's cloud relay to reach cameras behind NATs using only serial numbers. Hunt.io's analysis indicates the infrastructure was staged at least one year before the campaign launched, and the toolkit contained both original code and modified modules from at least four other developers.

Hunt.io assesses with moderate confidence that the toolkit was designed to transfer access to a third party, citing its transferable recovery-code design and enterprise-format export pipeline—though the evidence does not confirm a full commercial operation. The report does not establish the operator's ultimate motivation or intended use of the compromised cameras. Given the scale of the breach and the use of stolen credentials, users of Dahua devices should audit their firmware versions, rotate all passwords, and consider running a email breach checker to see if associated administrator accounts have been exposed in wider credential dumps.