ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
Product

HTTP File Server

0 mentions in 7 days · 1 in 30 days · 1 total · first seen · last

Search everything

Timeline

Inside Operation CameraSwarm: How One Actor Took Over 14,000 Dahua Cameras

One actor compromised over 14,000 Dahua cameras in Ukraine and Russia using brute-force, authentication bypass, and cloud relay serial-number abuse.

Hunt.io reconstructed Operation CameraSwarm from an exposed operator directory, revealing one actor compromised 14,000+ Dahua cameras between June 17 and July 22, 2026, mainly in Ukraine and Russia. The toolkit included a brute-force engine, a two-flaw 2021 authentication-bypass chain planting a persistent backdoor account on 1,923 cameras, and abuse of Dahua's cloud relay where 89.4% of probed serials returned open, unauthenticated channels. A SalatStealer Windows binary and Defender-disabling PowerShell script were staged on the same server but appear unrelated to the camera campaign.

Security Affairs · 27d agoThreat actor in the wildCVE-2024-39943CVE-2025-31702

Related CVEs

  • CVE-2024-399438.837%
    rejetto HFS (aka HTTP File Server) 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users (if they have Upload per
    rejetto HFS (aka HTTP File Server) 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users (if they have Upload permissions). This occurs because a shell is used to execute df (i.e., with execSync instead of spawnSync in child_process in Node.js).
    · rejetto http file server—
  • CVE-2025-317026.8<1%
    A vulnerability exists in certain Dahua embedded products.
    A vulnerability exists in certain Dahua embedded products. Third-party malicious attacker with obtained normal user credentials could exploit the vulnerability to access certain data which are restricted to admin privileges, such as system-sensitive files through specific HTTP request. This may cause tampering with admin password, leading to privilege escalation. Systems with only admin account are not affected.
    —

Appears with

malware SalatStealer 1organization Hunt.io 1product Dahua cameras 1vendor Amcrest 1vendor Annke 1vendor Dahua 1vendor Lorex 1vendor Rejetto 1vendor Swann 1
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.