Scope, scale and timeline of CameraSwarm
Over 35 days between June 17 and July 22, an operation Hunt.io calls CameraSwarm compromised 14,530 Dahua IP cameras, mostly in Ukraine and Russia. Hunt.io says the campaign ran at scale: the company recovered 407 MB of data containing 2,616 files across 234 directories that documented the intrusions, and allowed researchers to map the operator’s methods and targets.
Three parallel methods that yielded access
Hunt.io identified three attack vectors used in parallel to reach the 14,530 devices:
- Brute-force scanning on TCP port 37777. A system that scanned that port compromised devices at 12,324 unique IP addresses. The brute-force process captured usable camera snapshots, forwarded results to Telegram, and exported data for Dahua’s SMART PSS platform.
- Exploitation of CVE-2021-33044 and CVE-2021-33045. Using a toolkit Hunt.io calls p2pwn, the operator installed a persistent backdoor account (named p2pwn / p2password) on 1,923 cameras. Hunt.io reports this account survives password changes and, on most firmware versions, factory resets.
- Cloud-relay attacks via serial numbers and embedded SDK credentials. Using only serial numbers and SDK credentials embedded in Dahua applications, the operator reached 283 cameras behind NAT. Hunt.io’s data indicates 89.4% of live serials exposed an access channel without authentication.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleWhat Hunt.io recovered and the operator’s tradecraft
Hunt.io discovered the campaign after locating an unprotected working directory on an HTTP server the operator left exposed. The recovered material included source code, logs, credentials, captured camera images, shell history, and exploitation results. Those artifacts show the campaign scanned globally — first checking the Russian address space, then the entire IPv4 range — and that the operator concentrated activity on Russian and CIS telecom netblocks.
The researchers also found Russian-language comments inserted into repurposed public tools. Hunt.io notes two misleading vulnerability references in the toolkit — CVE-2024-39943 and CVE-2025-31702 — which were referenced but not used in observed attacks. The toolkit’s recovery-code generation relies on camera serial numbers; Hunt.io says that mechanism lets the operator redeem new recovery codes via Dahua’s standard password-recovery process without knowing the current administrator password.
Actionable remediation and remaining weaknesses
Hunt.io’s advisory lists concrete steps and cautions:
- Treat Dahua cameras that were reachable through port 37777 between June and July as potentially compromised and examine them for the presence of a 'p2pwn' account; remove the account if present.
- Be aware that removing the backdoor account does not invalidate recovery codes generated by the toolkit; those codes remain usable until Dahua changes the server-side derivation mechanism.
- Disable P2P if it is not required, and apply Dahua’s SA-2021-0130 firmware updates addressing CVE-2021-33044 and CVE-2021-33045, or a later firmware version.
Hunt.io also highlights a broader operational point: "Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply." The Blue Report 2026 is cited as measuring defenses technique-by-technique across 338 million simulations in customer production environments, underscoring that credentialed access materially reduces defensive effectiveness.
How camera owners, national CERTs, and Dahua are placed by these findings
Camera owners and security teams should immediately inspect devices reachable on port 37777 for the 'p2pwn' account, remove it where found, disable unnecessary P2P services, and install the SA-2021-0130 or later firmware updates. Owners must also consider the persistence of recovery-code-based access until Dahua modifies the recovery derivation server-side.
National CERTs received notification from Hunt.io on August 10, the same day Hunt.io alerted Dahua’s PSIRT; those teams now have data from the recovered artifacts (logs, snapshots, credentials) to prioritize incident response and outreach to affected network operators.
Dahua’s PSIRT is the named vendor contact in Hunt.io’s disclosure; the vendor’s responses and any server-side changes to recovery-code derivation will determine whether portions of the attack surface — notably the cloud-relay path that used serial numbers and embedded SDK credentials — remain exploitable.
Closing observation
CameraSwarm illustrates how an operator combined brute force, known-exploit chaining, and abuse of vendor recovery mechanisms to reach more than 14,500 devices in just over a month. Hunt.io’s recovered artifacts and the timing of its August 10 notifications give defenders and enumerators a clear list of immediate checks and firmware steps. One decisive open question the facts leave is operational: will adjustments on Dahua’s server-side recovery processes be made to close the serial-number–based redemption channel that Hunt.io found in active use?
