Hackers Compromise More Than 14,500 Dahua Security Cameras in Massive Campaign

A large-scale campaign dubbed Operation CameraSwarm compromised at least 14,530 Dahua IP cameras and related surveillance devices in just 35 days.

Exposing how unpatched flaws, weak credentials, and cloud-connected P2P features can turn video-security infrastructure into a remotely accessible attack surface.

Threat intelligence firm Hunt.io reconstructed the operation after discovering an unsecured HTTP directory belonging to the suspected operator.

The exposed server contained 407 MB of data across 2,616 files and 234 directories, including attack tooling, logs, credentials, shell history, camera images, and campaign records.

The activity ran from June 17 to July 22, with confirmed victim devices concentrated in Ukraine and Russia.

The operator did not rely on a single exploit chain. Instead, CameraSwarm used three concurrent access methods to maximize the number of compromised Dahua devices.

The largest component targeted cameras exposing Dahua’s TCP port 37777. Attackers brute-force credentials against 12,324 unique IP addresses, then collected accessible camera snapshots and exported results for use with Dahua’s SMART PSS management platform.

This portion of the operation illustrates the continued risk posed by default, reused, or weak administrator passwords on internet-facing surveillance systems.

A second path exploited CVE-2021-33044 and CVE-2021-33045, two known Dahua authentication-bypass vulnerabilities. The flaws can allow attackers to bypass device identity validation by sending crafted packets during authentication.

This backdoor account is particularly concerning because Hunt.io found that it could survive password changes and, on many firmware versions, factory resets.

An attacker who has planted the account may therefore retain administrative access after an organization believes it has remediated the initial intrusion.

The third attack path abused Dahua’s peer-to-peer cloud relay functionality to reach 283 cameras located behind network address translation.

In these cases, the operator used device serial numbers and SDK credentials embedded in Dahua applications to establish a route to devices that would otherwise not be directly exposed to the public internet.

Hunt.io Researchers linked this activity, to a tool called p2pwn, which was used to create a persistent account named p2pwn with the password p2password on 1,923 devices.

Dahua Security Cameras

Hunt.io’s recovered materials indicated that 89.4% of live serial numbers tested by the operator returned an open channel without authentication.

Every credential hit that survives filtering is posted immediately to a Telegram channel.

However, that percentage remains a campaign-specific finding from the exposed toolkit and has not been independently reproduced by Dahua, a CERT, or other public researchers.

The attack demonstrates a critical reality for enterprise and consumer IoT deployments: NAT is not a security boundary when cloud relay services can broker inbound connectivity.

Cameras, NVRs, and other connected physical-security systems should be treated as managed endpoints, not passive appliances.

CVE-2021-33044 and CVE-2021-33045 were disclosed in 2021, yet both remain listed in CISA’s Known Exploited Vulnerabilities catalog, which is intended to help defenders prioritize flaws with documented real-world exploitation.

The only other match is 159.65.136[.]18, a DigitalOcean host in Singapore. A two-count match is meaningful enough to warrant direct investigation rather than dismissal.

Dahua has issued repair software and updated firmware for impacted products.

Dahua said the reported methods primarily involved password cracking and exploitation of the two previously disclosed vulnerabilities.

The vendor recommended that customers use strong, unique passwords, monitor its security advisories, and update devices promptly. It also advised affected users to perform a full factory reset and install the latest firmware.

Organizations operating Dahua cameras or OEM-rebranded products should immediately identify devices exposed on port 37777 and investigate them as potentially compromised if they were internet-reachable during the campaign period.

Administrators should check for unauthorized accounts, especially p2pwn access, remove unused users, rotate all administrator credentials, and review NVR and camera access logs for anomalous sessions.

P2P connectivity should be turned off where it is not operationally necessary, while surveillance networks should be segmented from corporate systems.

Most importantly, defenders should install Dahua firmware addressing CVE-2021-33044 and CVE-2021-33045 or a later supported release and verify remediation rather than assuming a password reset alone removes attacker persistence.

Indicator	Type	Context
154.86[.]119.60	IPv4	Operator server, open directory, payload staging
185.132[.]53.56	IPv4	Second sighting of the identical payload; second operator touchpoint (see Windows Pivot)
easy4ipcloud[.]com:8800	Domain:port	Dahua P2P relay endpoint; abused legitimate infrastructure, not itself malicious
vk[.]com/wall-163997495	URL	VKontakte community link hardcoded in the operator’s Telegram notifications

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

★ Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.