Over 14,530 Dahua IP cameras were compromised between June 17 and July 22, 2026, according to analysis of a widespread campaign that combined brute-force credential attacks, exploitation of known authentication bypass flaws, and abuse of a cloud P2P relay.
How attackers gained initial access via Easy4IP P2P and predictable serials
The Computer Emergency Response Team of Ukraine (CERT-UA) and the State Special Communications Service of Ukraine (SSSCIP) tied unauthorized remote access to Dahua IP cameras and recorders to Easy4IP, a peer‑to‑peer (P2P) platform used to connect cameras to smartphone apps or browsers by scanning a QR code or entering a hardware Serial Number (SN). CERT‑UA warned that Dahua serial numbers follow a predictable format—a 10‑character model prefix identical within a device family plus a five‑character hexadecimal counter that increments almost sequentially (for example, 7K01F36PCA003E8).
The predictable structure, CERT‑UA said, "allows attackers to guess them at scale through a brute‑force attack and identify if they are connected to the cloud without hitting rate limits or lockouts." The agency counseled that, "The assumption that the serial number is unknown to anyone is not a reason to consider the device secure."
Authentication weaknesses and indicators of compromise
CERT‑UA outlined how attackers overcame authentication barriers by using weak or known passwords and by exploiting authentication bypass vulnerabilities present in outdated firmware, naming CVE‑2021‑33044 and CVE‑2021‑33045 specifically. The alert listed indicators of compromise that administrators should look for:
- Presence of unknown accounts on devices
- Unauthorized configuration changes
- Audit logs containing authentication events using Dahua's native DVRIP protocol and originating from the local address 127.0.0.1—a sign that access came via P2P
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildOperation CameraSwarm: scale, persistence, and cloud relay abuse
Hunt.io documented a second campaign, codenamed Operation CameraSwarm, attributing the activity to a lone threat actor and reporting that it had compromised over 14,530 Dahua IP cameras between June 17 and July 22, 2026. The attack pattern scanned for TCP port 37777 (Dahua's default management and streaming port), collected serial numbers, and then attempted access either by brute force or by chaining CVE‑2021‑33044 and CVE‑2021‑33045.
When access was obtained, the actor deployed a persistent backdoor account with the credentials "p2pwn / p2password" on nearly 2,000 cameras. Hunt.io reported that "1,923 cameras carry a persistent backdoor account (p2pwn / p2password), installed over RPC after either bypass," and warned that the account "is stored independently of the admin password and survives a password change and, on most firmware, a factory reset." In 283 cases, cameras were reached by serial number alone through Dahua's cloud relay without a visible device address and, in most cases, without credentials. Hunt.io also noted instances in which the cloud relay was abused to reach devices behind NAT using only serial numbers.
Parallel campaign, vulnerability mix, and geographic sweep
A separate campaign Hunt.io associated with a Russian‑speaking operator targeted internet‑exposed cameras in Ukraine using known Dahua and Hikvision flaws and compromised 58 devices. That activity used Ingram, a publicly available webcam vulnerability scanner, to exploit a mix of vendor weaknesses, including:
- CVE‑2017‑7921 (Hikvision authentication bypass)
- CVE‑2020‑25078 (D‑Link credential disclosure)
- CVE‑2020‑25169 (Reolink unauthenticated information disclosure)
- CVE‑2021‑33044 and CVE‑2021‑33045 (Dahua authentication bypasses)
- CVE‑2021‑36260 (Hikvision unauthenticated remote code execution)
In parallel the actor scanned and exploited TP‑Link and MikroTik routers and cameras using CVE‑2024‑53375 and CVE‑2024‑57049 across 15 European countries, including Ukraine, Poland, Romania, Moldova, Hungary, Czechia, Slovakia, Bulgaria, Germany, France, the Netherlands, Italy, Spain, the U.K., and Austria.
What this means for technologists, policymakers, and end users
- Technologists and security teams: Audit Dahua device accounts and logs for unknown users and DVRIP authentication events from 127.0.0.1; scan for exposed TCP port 37777 and validate whether devices are reachable via Easy4IP P2P; prioritize firmware updates that address CVE‑2021‑33044 and CVE‑2021‑33045.
- Policymakers and procurement leaders: Revisit standards for P2P services in vendor contracts and consider requiring controls that prevent serial‑number enumeration or that impose rate limits and lockouts; factor persistence mechanisms that survive resets into acquisition risk assessments.
- End users and small businesses: If P2P features are not required, disable them; avoid exposing devices directly to the internet; use strong, unique passwords and keep device firmware up‑to‑date as advised by CERT‑UA.
Earlier this year, Dutch intelligence agencies warned that Russian actors were compromising IP cameras across the E.U., NATO states, and Ukraine to conduct systematic digital espionage. That bulletin said, "This actor performs automated analysis of imagery through image recognition software to conduct targeted searches for military vehicles and the military cargo they are transporting," including transport routes and weapon deliveries.
CERT‑UA and the SSSCIP have not disclosed who was targeted, when these infections occurred beyond the Hunt.io timeline, how many devices had been infected overall, or who was responsible for the activity. The technical record in the alerts and Hunt.io's reporting, however, shows a repeatable chain: predictable serials plus P2P convenience plus unpatched authentication flaws can yield remote access at scale—and, according to the Dutch bulletin, that access can be turned into automated imagery analysis with operational consequences.
