Inside Operation CameraSwarm: How One Actor Took Over 14,000 Dahua Cameras
One actor compromised over 14,000 Dahua cameras in Ukraine and Russia using brute-force, authentication bypass, and cloud relay serial-number abuse.
Hunt.io reconstructed Operation CameraSwarm from an exposed operator directory, revealing one actor compromised 14,000+ Dahua cameras between June 17 and July 22, 2026, mainly in Ukraine and Russia. The toolkit included a brute-force engine, a two-flaw 2021 authentication-bypass chain planting a persistent backdoor account on 1,923 cameras, and abuse of Dahua's cloud relay where 89.4% of probed serials returned open, unauthenticated channels. A SalatStealer Windows binary and Defender-disabling PowerShell script were staged on the same server but appear unrelated to the camera campaign.
- 14,000+ Dahua cameras compromised across Ukraine and Russia
- Cloud relay allowed access using only serial numbers with shared baked-in credentials
- Backdoor account survived password changes and most factory resets
- Tooling was assembled from public repositories of at least six other developers
- Recovery-code generator can unlock Dahua cloud account recovery offline
- ATT&CK
- T1110 Brute ForceT1062 Hijack Execution FlowT1136 Create AccountT1543 Create or Modify System ProcessT1562 Impair Defenses
- Products
- Dahua camerasHTTP File Server
- Malware
- SalatStealer
- Organizations
- Hunt.io
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-39943 | rejetto HFS (aka HTTP File Server) 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users (if they have Upload… | 8.8 | 37% | ||
| CVE-2025-31702 | A vulnerability exists in certain Dahua embedded products | 6.8 | <1% |
From the original article
4 min read at securityaffairs.com
An exposed operator directory reveals how one actor compromised 14,000+ Dahua cameras across Ukraine and Russia, no password needed for most. A researcher discovered an exposed directory containing the tools of an attacker who compromised more than 14,000 Dahua cameras between June 17 and July 22, 2026, mainly in Ukraine and Russia. Hunt.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.