CameraSwarm Operation Compromises Over 14,500 Dahua IP Cameras

Between June 17 and July 22, 2026, hackers compromised over 14,500 Dahua IP cameras, primarily in Ukraine and Russia, in a campaign dubbed CameraSwarm. The attackers exploited vulnerabilities, brute-forced logins, and utilized offline recovery codes from camera serial numbers. Hunt.io discovered the operation after finding an exposed directory containing 2,616 files, including source code and credentials. The attack toolkit allowed access to cameras without needing passwords for most devices. The campaign was reported to national CERTs and Dahua's PSIRT on August 10, 2026. Users are advised to check for a 'p2pwn' account and apply firmware updates to mitigate risks. The vulnerabilities referenced include CVE-2021-33044 and CVE-2021-33045, both of which have known patches.

Key Points: • Over 14,500 Dahua IP cameras were compromised in a 35-day operation. • Attack methods included brute-forcing logins and exploiting offline recovery codes. • Hunt.io recovered extensive data from the attacker's exposed server, aiding in the investigation.