Hackers Compromised 14,500+ Dahua Devices Using Credential Attacks, Auth Bypasses, and P2P
Cybersecurity researchers at Hunt.io have disclosed details of a campaign that compromised more than 14,530 Dahua devices between June 17 and July 22, 2026, using credential attacks, two authentication-bypass flaws, and a peer-to-peer (P2P) relay technique.
Intelligence analysis by Llama
The campaign, codenamed Operation CameraSwarm, was reconstructed from a 407 MB exposed working directory containing 2,616 files across 234 subdirectories, including tooling, logs, shell history, and campaign records.
Imagine you have a network of cameras that can be controlled remotely. Hackers found a way to take control of over 14,500 of these cameras using a combination of tricks. They used fake accounts, exploited weaknesses in the cameras' software, and even created a way to connect to the cameras without needing a password. This is a big deal because these cameras are used for security and surveillance, and if they can be controlled by hackers, it could lead to all sorts of problems.
Analysis
Operation CameraSwarm: A Campaign of Compromise and Control
The recent disclosure by Hunt.io of a campaign that compromised over 14,500 Dahua devices has sent shockwaves through the cybersecurity community. The campaign, codenamed Operation CameraSwarm, utilized a combination of credential attacks, authentication-bypass flaws, and a peer-to-peer (P2P) relay technique to gain access to these devices. The compromised devices, primarily Dahua IP cameras, were concentrated in Ukraine and Russia, with a total of 1,923 cameras configured with a persistent account during the operation.
The researchers at Hunt.io attributed the 14,530-plus total to three attack paths: credential attacks, authentication bypass, and P2P relay. The credential attacks accounted for 12,324 unique IP addresses across 13,229 campaign records, while the authentication bypass utilized two vulnerabilities, CVE-2021-33044 and CVE-2021-33045, which were also configured with the persistent account. The P2P relay, on the other hand, identified 283 cameras, including devices located behind network address translation (NAT).
The two 2021 flaws, CVE-2021-33044 and CVE-2021-33045, are authentication-bypass vulnerabilities in Dahua cameras and related products. Dahua's advisory rates them 8.1 on the CVSS scoring system and lists fixed firmware, while the U.S. National Vulnerability Database (NVD) currently assigns each a CVSS score of 9.8. The vulnerabilities allow attackers to bypass device identity authentication by constructing malicious data packets.
The P2P path, separate from the two authentication-bypass flaws, was found to be reinforced in firmware released after mid-2024. ITRES Labs advised defenders to disable P2P unless required, restrict Easy4IP connectivity where appropriate, update devices using firmware from the vendor's website, use strong unique credentials, remove unused accounts, and segment video surveillance systems.
Dahua's advisory directs customers to install the listed repair software or newer firmware. The researchers described the operator as Russian-speaking based on language artifacts recovered from the working directory, but the activity has not been attributed to a named threat actor, a Russian government entity, or another known group.
The campaign-specific totals of more than 14,530 devices, 1,923 persistent accounts, 283 P2P compromises, and the 89.4% open-channel figure remain attributed to Hunt.io. The public primary sources reviewed for this story corroborate the two old authentication bypasses, the p2pwn tool configuration, and the underlying serial-number P2P mechanism, but do not independently confirm the 89.4% open-channel figure.
Key points
- Over 14,500 Dahua devices were compromised using credential attacks, authentication-bypass flaws, and a P2P relay technique.
- The compromised devices were primarily Dahua IP cameras, concentrated in Ukraine and Russia.
- The researchers attributed the compromise to three attack paths: credential attacks, authentication bypass, and P2P relay.
- The two 2021 flaws, CVE-2021-33044 and CVE-2021-33045, are authentication-bypass vulnerabilities in Dahua cameras and related products.
- ITRES Labs advised defenders to disable P2P unless required, restrict Easy4IP connectivity where appropriate, and update devices using firmware from the vendor's website.
If the affected devices are updated with the latest firmware and the P2P relay is disabled, the risk of further compromise can be significantly reduced. Additionally, the disclosure of this campaign can lead to improved security measures being implemented by Dahua and other manufacturers, making their devices more secure in the future.
The fact that over 14,500 devices were compromised suggests that the vulnerabilities exploited by the hackers are still present in many devices. If these devices are not updated or secured properly, it could lead to further compromises and potentially even more severe consequences.
