Operation CameraSwarm: scope, timeline, and recovered workspace
Hunt.io said it reconstructed the campaign from a 407 MB exposed working directory containing 2,616 files across 234 subdirectories — tooling, logs, shell history, and campaign records — and attributed confirmed compromises as concentrated in Ukraine and Russia. The firm reported the campaign totals as more than 14,530 devices, with 12,324 unique IP addresses tied to credential attacks, 1,923 cameras reached via authentication-bypass flaws, and 283 cameras reached by a peer-to-peer (P2P) relay technique.
Three distinct attack paths identified
- Credential attacks: Hunt.io tied 12,324 unique IP addresses across 13,229 campaign records to brute-force or credential-based access attempts.
- Authentication bypass: The firm said 1,923 cameras were reached using two 2021 flaws, CVE-2021-33044 and CVE-2021-33045, and that those devices were also configured with a persistent account.
- P2P relay: Hunt.io identified 283 cameras by serial number that were reached through a vendor relay path, including devices located behind network address translation (NAT).
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleHow the authentication bypasses and P2P relay work, and the public record
The two 2021 flaws are described as authentication-bypass vulnerabilities in Dahua cameras. Dahua's advisory says attackers can "bypass device identity authentication by constructing malicious data packets." The original disclosure from researcher Bashis described a NetKeyboard client type triggering CVE-2021-33044 during authentication and CVE-2021-33045 involving a loopback login request using 127.0.0.1.
Both CVE-2021-33044 and CVE-2021-33045 remain listed in the U.S. Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities (KEV) catalog as Dahua IP camera authentication-bypass vulnerabilities; CISA advises applying vendor mitigations or discontinuing use where mitigations are unavailable.
Separately, multiple public repositories and prior analyses document a serial-number-based P2P mechanism. The public p2pwn repository, accessible as of August 19, 2026, independently confirms the tool accepts Dahua serial numbers as input, checks CVE-2021-33044 and CVE-2021-33045, and contains a default dummy-account configuration. The dh-p2p proof-of-concept repository shows the Dahua P2P protocol locating a device through Easy4IPCloud by serial number and establishing a tunnel to the camera or network video recorder.
Evidence, contested claims, and vendor response
Hunt.io's recovered operator code recorded that 89.4% of live serial numbers returned an open channel without authentication, and the firm reported that 1,923 cameras were configured with a persistent account. Those campaign-specific totals and the 89.4% figure remain Hunt.io claims based on the recovered material and have not been independently reproduced by ITRES Labs, Dahua, or a public computer emergency response team advisory located as of August 19, 2026.
ITRES Labs — which conducted earlier incident-response testing — characterized the serial-number relay exposure as a non-CVE issue and said firmware released after mid-2024 reinforced the P2P path. ITRES Labs warned that on firmware before mid-2024, a valid Dahua serial number could establish an Easy4IP relay path before the connected device performed its own credential check, allowing a device behind NAT to become reachable through the vendor's relay infrastructure.
Dahua's advisory rates the two 2021 flaws at 8.1 on the vendor's CVSS scale and lists fixed firmware; the U.S. National Vulnerability Database assigns each a CVSS score of 9.8. Dahua directs customers to install the listed repair software or newer firmware.
What this means for technologists, policymakers, and end users
- Technologists and security teams: ITRES Labs advised disabling P2P where it is not required, restricting Easy4IP connectivity, updating devices only with firmware downloaded from the vendor's site, using strong unique credentials, removing unused accounts, and segmenting video surveillance systems.
- Policymakers and regulators: The two authentication-bypass CVEs remain on CISA's KEV list, which advises applying vendor mitigations or discontinuing use when mitigations are unavailable.
- End users and administrators: Hunt.io's timeline and Dahua's advisory converge on the same practical step — install the corresponding fix software or newer firmware and evaluate whether P2P relay functionality is required for each device.
Hunt.io described the recovered operator as Russian-speaking based on language artifacts in the working directory but did not attribute the activity to a named threat actor or state. The firm assessed with moderate confidence that parts of the toolkit may have been designed to transfer camera access to a third party. Public technical records corroborate the two old authentication bypasses, the p2pwn tool configuration, and the underlying serial-number P2P mechanism, but do not independently confirm Hunt.io's campaign-wide device counts.
