Skip to content

Operation CameraSwarm: 14,500+ Dahua cameras compromised via auth bypass and P2P relay

Summary

Hunt.io disclosed Operation CameraSwarm, a campaign that compromised more than 14,530 Dahua devices between June 17 and July 22, 2026, using credential attacks, two 2021 authentication-bypass flaws, and a peer-to-peer (P2P) relay technique. Confirmed compromises were concentrated in Ukraine and Russia. The campaign was reconstructed from a 407 MB exposed working directory containing 2,616 files across 234 subdirectories — tooling, logs, shell history, and campaign records.

Tags

Attack paths

Hunt.io attributes the 14,530+ total to three attack paths:

  1. CVE-2021-33044 — authentication bypass in Dahua cameras/related products. A NetKeyboard client type triggers the flaw during authentication. Dahua's advisory rates it 8.1; NVD assigns CVSS 9.8. "Attackers can bypass device identity authentication by constructing malicious data packets," Dahua's advisory says.
  2. CVE-2021-33045 — loopback login request using the 127.0.0.1 address (original disclosure by researcher Bashis). NVD CVSS 9.8.
  3. P2P relay technique — the P2P relay establishes the route without prior authentication, leaving login checks to the device's web application (ITRES Labs, October 2025). The serial-number relay exposure was described by ITRES as a non-CVE issue; its testing found the P2P path was reinforced in firmware released after mid-2024. Tooling observed includes p2pwn configuration.

Campaign totals (Hunt.io): - 1,923 cameras configured with a persistent account during the operation. - 283 cameras reached through the P2P path. - 89.4% of observed compromises over open/unauthenticated channels (per Hunt.io's figures).

The two CVEs remain in the CISA KEV catalog as of August 19, 2026. Two other CVE labels associated with the recovered tooling do not describe the P2P behavior (CVE-2024-39943 is a Rejetto HFS OS command-injection flaw; Dahua's CVE-2025-31702 is a privilege-escalation flaw requiring existing normal-user credentials).

Attribution and tooling notes

  • The operator is described as Russian-speaking based on language artifacts in the working directory.
  • Not attributed to a named threat actor, Russian government entity, or known group.
  • Hunt.io assessed with moderate confidence that parts of the toolkit may have been designed to transfer camera access to a third party — i.e., the compromised cameras may have been sold or handed off, not just held.

Why this matters

  • Fifteen-year-old (2021) auth-bypass flaws remain the primary mass-compromise vector for an entire camera vendor's install base — patching, not detection, is the durable fix.
  • The P2P relay bypasses the need for a direct path to the device: the relay establishes the route unauthenticated and the web application's own (bypassed/weak-credentialed) login check is the only gate.
  • Persistent accounts (1,923) are the long-tail risk: even after the campaign ended, planted accounts keep working until rotated.

Defender priorities

  1. Update Dahua devices to the vendor's listed repair software or newer firmware (both CVEs are in KEV; the P2P path was reinforced in post-mid-2024 firmware).
  2. Disable P2P / Easy4IP where not required; restrict P2P connectivity at the network layer.
  3. Rotate and remove accounts: audit for persistent/added camera accounts; use strong unique credentials; remove unused accounts.
  4. Segment video-surveillance systems from general networks and, where feasible, from the public internet.
  5. Hunt for p2pwn-style relay abuse and serial-number-based P2P access in camera logs.
  6. Assume third-party handoff: if a camera was in this window (June 17–July 22, 2026), treat any standing account as potentially held by a second party.

Assessment limits

  • The campaign-specific counts (14,530+ devices, 1,923 persistent accounts, 283 P2P, 89.4% open-channel) are Hunt.io's reconstruction from the exposed working directory; public primary sources corroborate the two auth bypasses, the p2pwn tool configuration, and the serial-number P2P mechanism, but do not independently confirm those counts.
  • No named attribution; "Russian-speaking operator" is a linguistic observation, not a government/actor attribution.
  • Dahua had not publicly confirmed campaign scope or P2P findings as of August 19, 2026.

Sources