In short: Between June 17 and July 22, 2026, a single threat actor compromised 14,530 Dahua IP cameras across Russia and Ukraine by exploiting five-year-old vulnerabilities and weak default credentials. Victims received no notification — the attacker silently captured camera snapshots and exfiltrated credentials to a Telegram channel. National CERTs and Dahua were alerted only on August 10, 2026, when Hunt.io researchers discovered the attacker's own exposed server containing a complete operational archive.
What Happened
On August 10, 2026, threat intelligence firm Hunt.io disclosed Operation CameraSwarm: over 35 days, one operator compromised more than 14,530 Dahua IP cameras. Researchers discovered an unprotected HTTP directory on the attacker's server — it held 2,616 files (407 MB) including custom tool source code, operation logs, harvested camera credentials, captured snapshots, shell command history, and exploitation results. The attacker made a classic operational security mistake by leaving the entire infrastructure publicly accessible.
The operation concentrated on Russia and Ukraine, which accounted for the largest share of compromised devices. Affected cameras included units installed in residential buildings, car parks, and commercial premises. The incident illustrates how exposed consumer-grade IoT devices remain when shipped with default configurations and left unpatched for years.
Three Attack Methods
The operator ran three parallel exploitation paths, each automated with custom scripts:
- Credential brute-force. An asyncio-based scanner targeted port 37777 — Dahua's proprietary Easy4IP management protocol — scaling to 4,000 concurrent workers. It tested 12,324 unique IP addresses, hunting for devices running weak or default credentials.
- CVE-2021-33044 and CVE-2021-33045 exploitation. Using the p2pwn tool, the attacker bypassed authentication entirely — no password required. CVE-2021-33044 exploits a NetKeyboard hardware-trust bypass; CVE-2021-33045 abuses loopback source-address spoofing. This chain installed a persistent "p2pwn" backdoor account on 1,923 cameras.
- Dahua cloud relay abuse. Cameras behind NAT with no direct public IP were reached through Dahua's own P2P cloud infrastructure using only the device's serial number. Of 283 tested serials, 89.4% returned open channels requiring no authentication whatsoever.
Both CVEs were patched by Dahua in October 2021 under bulletin SA-2021-0130 — meaning the compromised cameras had been running unpatched for more than four years.
What Data Was Stolen
The attacker harvested 13,229 credential records from 52 SMART PSS XML export files — Dahua's own device management client. Additional stolen items included ONVIF credentials cached on cameras, device serial numbers, and offline recovery codes that grant administrative access through the serial number alone.
Most notably, the attacker captured camera snapshots. Using brightness and edge-density filtering algorithms to select informative frames, the collected images were immediately forwarded to a Telegram channel with a hardcoded link to a VKontakte community embedded in the attacker's code.
The same server also hosted SalatStealer — a UPX-packed Windows credential stealer with a Defender bypass script — indicating the attacker's capabilities extended well beyond IoT targets.
What This Means for Ordinary Users
A home or office IP camera is not just a perimeter security device. It is a microphone and lens connected to the internet: once compromised, it becomes a tool for surveillance of the people inside the premises. In this operation, the attacker obtained live snapshots from residential interiors and commercial spaces.
Crucially, victims received zero notification. Their cameras continued displaying a normal feed — nothing indicated a breach. This is precisely what makes IoT attacks so dangerous: silent, invisible, and potentially months-long. The same hidden persistence was documented in the Android car head unit malware case we covered earlier.
A secondary risk: your internet connection weaponised. Even if the attacker is not interested in your camera's video, the device may be enlisted as a proxy node to route and anonymise their own traffic. From the outside, those requests appear to originate from you.
How to Protect Your Camera
Both exploited CVEs were patched by Dahua in 2021. If your camera has not been updated since then, it may be vulnerable right now. Steps to take:
- Update the firmware to the latest version from Dahua's official site (dahuasecurity.com). Bulletin SA-2021-0130 closes both CVE-2021-33044 and CVE-2021-33045.
- Change the default password to a long, unique one. Brute-force attacks specifically target standard credentials like "admin/admin".
- Audit the user list in the camera settings. Find and delete any account named "p2pwn" — its presence is a confirmed indicator of compromise.
- Disable P2P cloud relay if you do not need remote viewing through Dahua's cloud service (Settings → Network → P2P). This fully eliminates the third attack vector.
- Block port 37777 on your router if the camera does not need direct internet access. Most home cameras function perfectly within a local network only.
- Encrypt your home network traffic. LiMP VPN on your smartphone or router encrypts traffic between your network and the internet, closing interception opportunities. More IoT security tips are on our blog.