Hackers Compromised 14,500+ Dahua Devices Using Credential Attacks, Auth Bypasses, and P2P
Hunt.io disclosed Operation CameraSwarm, compromising 14,500+ Dahua cameras via credential attacks, auth bypass CVEs, and P2P relay techniques across Ukraine and Russia.
Hunt.io reconstructed a campaign codenamed Operation CameraSwarm that compromised over 14,530 Dahua devices between June 17 and July 22, 2026. Attack paths included credential attacks against 12,324 IPs, exploitation of CVE-2021-33044 and CVE-2021-33045 affecting 1,923 cameras, and P2P relay access to 283 devices behind NAT. The operator, assessed as Russian-speaking, left behind 2,616 files including tooling and campaign logs, with confirmed compromises concentrated in Ukraine and Russia. Dahua advises factory resets and firmware updates; both 2021 CVEs remain in CISA's KEV catalog.
- Operation CameraSwarm compromised 14,530+ Dahua cameras across three attack vectors
- CVE-2021-33044 and CVE-2021-33045 auth bypasses used on 1,923 cameras with persistent account deployment
- P2P relay via Easy4IP allowed 283 devices behind NAT to be reached without authentication
- Operator tooling recovered from 407 MB exposed directory; activity attributed only to Russian-speaking actor
- Both 2021 CVEs remain in CISA KEV; users urged to update firmware, disable P2P, and use strong credentials
- ATT&CK
- T1110 Brute ForceT1068 Exploitation for Privilege EscalationT1098 Account ManipulationT1219 Remote Access Software
- Vendors
- DahuaHunt.ioITRES LabsCISA
- Products
- Dahua IP camerasEasy4IPp2pwn
- Threat actors
- Operation CameraSwarm
- Organizations
- NVD
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2021-33044+1 related CVE | Authentication Bypass in Dahua IP Camera Firmware | 9.8 | 100% | KEVPoC ×2 | KEV |
| CVE-2024-39943 | rejetto HFS (aka HTTP File Server) 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users (if they have Upload… | 8.8 | 37% | ||
| CVE-2025-31702 | A vulnerability exists in certain Dahua embedded products | 6.8 | <1% |
From the original article
4 min read at thehackernews.com
Cybersecurity researchers at Hunt. io have disclosed details of a campaign that they say compromised more than 14,530 Dahua devices between June 17 and July 22, 2026, using credential attacks, two authentication-bypass flaws, and a peer-to-peer (P2P) relay technique.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.