Reported by 7 outlets
Hackers compromise 14,500 Dahua web cameras in 35-day campaign
Why this score
- Breadth
- 2.00 / 2.0 · 7 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 5.00 / 5.0 · CVSS + KEV signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
CameraSwarm is not a single clean build but a 35-day operation between June 17 and July 22, 2026 that compromised 14,530 Dahua IP cameras through three parallel paths. The brute-force engine scanned TCP port 37777 and reached 12,324 unique IP addresses, capturing snapshots and sending results to Telegram. A second path chained CVE-2021-33044 and CVE-2021-33045 through the compiled tool p2pwn to install a persistent backdoor account (p2pwn / p2password) on 1,923 cameras; the account is stored independently of the admin password and survives both password changes and, on most firmware versions, factory resets. A third path abused Dahua's cloud P2P relay by serial number to reach 283 cameras behind NAT, with the operator's own logs showing 89.4 percent of live serials returned an open channel requiring no authentication at all. Hunt.io recovered the operator's entire working environment, 407 MB across 2,616 files in 234 directories, from an exposed HTTP directory at 154.86.119.60.
The strategic weight of this campaign is greater than a routine camera breach. The largest share of confirmed compromises concentrated in Ukraine, with significant hits in Russia, Mexico, and Vietnam, which places internet-exposed surveillance infrastructure in active conflict zones directly under the control of an actor whose toolkit includes transferable access: offline recovery codes, SMART PSS enterprise-format exports, and a persistent backdoor that outlasts standard remediation. The presence of a separate Windows malware payload (UPX-packed, tagged as SalatStealer) and a five-method Defender exclusion script targeting C: wholesale suggests the same host staged capabilities beyond camera exploitation, yet the event timeline does not confirm whether that payload activated. This gap between toolkit readiness and observed action is the critical uncertainty for defenders.
Defenders should treat any camera reachable on port 37777 during the campaign window as a potential compromise and audit device account lists specifically for p2pwn, removing it if found. The authentication-bypass chain requires unpatched firmware; Dahua advisory SA-2021-0130 (first published 2021-09-01) covers CVE-2021-33044 and CVE-2021-33045 with fixed versions such as DH_IPC-HX1XXX-Molec_MultiLang_PN_V2.820.0000000.33.R.210705 for the IPC-HX1XXX series, and corresponding builds for other affected families. Block TCP 37777 externally unless required. For hunting, inspect login requests carrying "clientType": "NetKeyboard" or "loginType": "Loopback" with "ipAddr": "127.0.0.1"; these are the exact payload structures from the recovered source. Monitor for Telegram exfiltration patterns, SMART PSS XML batch exports, and serial-prefix brute patterns matching the operator's thirteen prefixes (e.g., AH1058FPAG, 5E00107PAJ). Remove Dahua P2P relay where not actively used, since serial-based access is independent of device credentials.
Two developments would change the assessment materially. First, whether Dahua firmware updates are deployed to invalidate previously issued cloud recovery codes; Dahua states that updates block new code generation and cause existing codes to refresh and eventually expire, but until that process completes, previously recovered codes remain a live risk separate from the backdoor account. Second, whether the Windows pivot activates in the wild: the SalatStealer-tagged binary (hash de03a0ae5c7aa0c237ae36a649875f986fd9701ac06857dd214054367ce5090c) appeared on the same host and on a second address (185.132.53.56) two days later, and the Defender-evasion script includes Group Policy persistence, which points to enterprise targeting rather than opportunistic IoT exploitation. Confirmation of either event would elevate this from a camera-focused espionage operation to a broader infrastructure compromise.
Timeline
-
update from dahuasecurity.com
Dahua Security Advisory - Identity authentication bypass vulnerability (SA-2021-0130)
dahuasecurity.com · 1869d ago · September 1st, 2021
Dahua published its security advisory on 2021-09-01 (SA ID DHCC-SA-202106-001, updated 2021-11-15) covering CVE-2021-33044 and CVE-2021-33045. The advisory confirms identity authentication bypass during login in multiple Dahua product series including IPC-HX, HUM7XXX, HX8XXX, VTO, VTH, NVR, XVR, and PTZ cameras. Affected firmware versions are those with build time before June 2021 (CVE-2021-33044) or before May 2020 (CVE-2021-33045), with corresponding fixed software versions listed for each model family.
-
update from ipvm.com
IPVM Report - Dahua New Critical Vulnerabilities 2021
ipvm.com · 1863d ago · September 7th, 2021
IPVM reported on 2021-09-07 that researcher Bashis discovered new critical authentication bypass vulnerabilities in Dahua products, warning they have very high potential for mass exploitation. The article covers the initial limited disclosure on September 6, 2021 and the vendor advisory released the same day. It provides context on the severity and potential for mass attacks against unpatched Dahua cameras.
-
update from seclists.org
Bashis Full Disclosure - Dahua Authentication Bypass (CVE-2021-33044, CVE-2021-33045)
seclists.org · 1834d ago · October 6th, 2021
Security researcher Bashis (mcw@noemail.eu) published full disclosure on 2021-10-06 after limited disclosure on 2021-09-06. The disclosure documents two authentication bypass techniques: CVE-2021-33044 (NetKeyboard clientType trust bypass) and CVE-2021-33045 (loopback source-address spoof). Both return full administrator sessions without valid credentials. A proof-of-concept repository (DahuaConsole) and a timeline of vendor interaction from June 13 through October 6, 2021 are included.
-
update from hunt.io
Hunt.io - Operation CameraSwarm: Over 14,000 Dahua cameras compromised
hunt.io · 57d ago · August 18th, 2026
Hunt.io published its original research blog on 2026-08-18 (held until then under TLP:AMBER after CERT notifications on 10 August 2026). The report documents a 35-day campaign (June 17 to July 22, 2026) that compromised 14,530+ Dahua IP cameras using brute-force, authentication bypass (CVE-2021-33044/CVE-2021-33045), and P2P relay abuse. It details the persistent p2pwn backdoor account, recovered 407 MB of operator files, and notes that the campaign concentrated in Ukraine and Russia.
-
update from bleepingcomputer.com
Hackers compromise 14,500 Dahua web cameras in 35-day campaign
bleepingcomputer.com · 55d ago · August 19th, 2026
In a large-scale campaign that researchers dubbed CameraSwarm, hackers compromised more than 14,500 Dahua IP cameras mostly in Ukraine and Russia. The operation ran for at least 35 days between June 17 and July 22, compromising devices by exploiting vulnerabilities, brute-forcing logins, and using offline recovery codes from serial numbers for cloud-registered cameras. Researchers at threat intelligence company Hunt.io discovered the campaign after finding a working directory on an HTTP server that the operator left unprotected. Hunt.io recovered 407 MB of data comprising 2,616 files across 234 directories, including source code, logs, credentials, captured camera images, shell history, and exploitation results, which helped them map an impressive operation. CameraSwarm campaign overview Source: Hunt.io According to their findings, the 35-day CameraSwarm campaign compromised 14,530 Dahua IP cameras using three attack methods in parallel: A brute-forcing system scanned TCP port 37777 and compromised devices at 12,324 unique IP addresses. It captured usable camera snapshots, sent results to Telegram, and exported them for Dahua’s SMART PSS platform. The account survives password changes and, on most firmware versions, factory resets. A cloud-relay attack reached 283 cameras behind NAT using only serial numbers
-
update from gbhackers.com
Hackers Compromise More Than 14,500 Dahua Security Cameras in Massive Campaign
gbhackers.com · 39d ago · September 4th, 2026
Exposing how unpatched flaws, weak credentials, and cloud-connected P2P features can turn video-security infrastructure into a remotely accessible attack surface. Threat intelligence firm Hunt.io reconstructed the operation after discovering an unsecured HTTP directory belonging […] The post Hackers Compromise More Than 14,500 Dahua Security Cameras in Massive Campaign appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from cyberpress.org
CameraSwarm Hackers Compromise 14,500+ Dahua Cameras, Backdoor 1,900 Devices
cyberpress.org · 39d ago · September 4th, 2026
Investigators found that 1,923 of the affected devices received a persistent backdoor account, potentially allowing attackers to regain access even after an administrator changes the main password. While scans covered global IP address ranges, confirmed compromises were concentrated in Ukraine and Russia, with the largest number of affected systems located in Ukraine . The campaign also hit networks in Mexico and Vietnam. Researchers uncovered the operation after an attacker-operated server exposed an open HTTP directory. The server contained 2,616 files across 234 folders, including scanning tools, exploitation utilities, stolen-camera records, scripts, and a separate Windows malware payload. CameraSwarm Backdoors Dahua Cameras CameraSwarm used several methods to reach Dahua cameras. Its brute-force engine targeted Dahua’s Easy4IP management service on TCP port 37777, recovering access to 12,324 unique IP addresses. It reportedly sent successful credential results to a Telegram channel and saved images locally.