Back Securityaffairs.Co

Inside Operation CameraSwarm: How One Actor Took Over 14,000 Dahua Cameras

Securityaffairs.Co •Pierluigi Paganini • August 19, 2026

An exposed operator directory reveals how one actor compromised 14,000+ Dahua cameras across Ukraine and Russia, no password needed for most. A researcher discovered an exposed directory containing the tools of an attacker who compromised more than 14,000 Dahua cameras between June 17 and July 22, 2026, mainly in Ukraine and Russia. Hunt.io reconstructed the […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

CameraSwarm Operation Compromises Over 14,500 Dahua IP Cameras Between June 17 and July 22, 2026, hackers compromised over 14,500 Dahua IP cameras, primarily in Ukraine and Russia, in a campaign dubbed CameraSwarm. The attackers exploited vulnerabilities, brute-forced logins, and utilized offline recovery codes from camera serial numbers. Hunt.io discovered the operation after finding an exposed directory containing 2,616 files, including source code and credentials. The attack toolkit allowed access to cameras without needing passwords for most devices. The campaign was reported to national CERTs and Dahua's PSIRT on August 10, 2026. Users are advised to check for a 'p2pwn' account and apply firmware updates to mitigate risks. The vulnerabilities referenced include CVE-2021-33044 and CVE-2021-33045, both of which have known patches. 15 sources 75

Extracted Entities

Inside Operation CameraSwarm: How One Actor Took Over 14,000 Dahua Cameras

The full story

Extracted Entities

Campaigns (1)

Countries (2)

Domains (1)