Operation CameraSwarm: How Hackers Quietly Compromised 14,500 Dahua Cameras

Researchers have unpicked one of the more revealing surveillance camera campaigns of the year. Between 17 June and 22 July, an operator compromised more than 14,500 Dahua devices worldwide. The story of how they did it says more about Dahua camera security than any single patch note ever could.

The findings come from Hunt.io, which found the operator’s own working directory sitting exposed on a public server. Inside were 2,616 files totalling 407MB: scripts, logs, shell history and campaign records. In effect, the researchers found the operator’s entire toolkit, laid bare for anyone who knew where to look. ITRES Labs later confirmed parts of the analysis.

Three routes into the same devices

The campaign did not rely on one clever trick. It ran three parallel attack paths at once. Each one aimed at a different weak point in Dahua camera security.

The first was a straightforward credential attack. An asyncio-based scanning engine hit 12,324 unique IP addresses on port 37777, Dahua’s Easy4IP protocol port. It scaled up to 4,000 concurrent workers as it went. No cleverness required, just patience and scale.

The second path exploited two authentication bypass flaws: CVE-2021-33044 and CVE-2021-33045. Both are rated 9.8 out of 10 on the CVSS scale. Both were disclosed back in October 2021, and both have sat in CISA’s Known Exploited Vulnerabilities catalogue since August 2024. Using them, the operator planted persistent backdoor accounts on 1,923 cameras. These accounts survive password changes. On many devices they even survive a factory reset, so simply resetting a compromised camera would not remove the intruder.

The third path was the most unusual: cloud relay abuse. Dahua’s Easy4IP system lets owners reach cameras behind home or office routers, without ever configuring port forwarding. The operator turned that convenience against its owners. Using nothing more than a device’s serial number, they reached 283 cameras hidden behind NAT. As ITRES Labs put it, “the relay establishes the route without prior authentication, leaving login checks to the device’s web application.”

Why the toolkit matters as much as the target

What stands out is that this was not a bespoke operation. Hunt.io describes the kit as “assembled, not authored.” It was built from components credited to at least six different developers: a Go binary called p2pwn for the authentication bypasses, an asyncio brute-force scanner, a camera fingerprinting tool, and a generator for offline recovery codes. An unrelated Windows credential stealer, SalatStealer, was also found bundled in, apparently reused rather than written for this job.

That matters for Dahua camera security because it lowers the bar for entry. A single competent operator, working with public exploit code and off-the-shelf tooling, reached thousands of cameras in five weeks. Nothing about the campaign required nation-state resources.

The researchers assess, with moderate confidence, that the toolkit may have been built for handoff to a third party. That assessment rests on how transferable the recovery codes are, and on how the campaign’s output was formatted. They stop short of naming a threat actor. Language artefacts in the recovered files point to a Russian-speaking operator, with confirmed compromises concentrated in Ukraine and Russia.

What this means beyond the headline numbers

Most coverage of this story leads with the device count. The more useful number for a business running Dahua kit is 89.4%. That is the share of live camera serial numbers said to return an open channel with no authentication at all, according to material recovered from the operator’s own logs. That figure has not been independently verified. Even a fraction of it would be a serious gap in Dahua camera security for any business with cameras registered to Dahua’s cloud service.

Firms in the UK and beyond deploy Dahua-branded and Dahua-manufactured hardware widely, often under other brand names. So you will find it in retail premises, warehouses, car parks and office reception areas. Few of those cameras were bought with a threat model in mind. They were bought to watch a door.

That gap between purpose and protection is exactly where campaigns like this one thrive. Still, a camera feed does not need to be dramatic to be valuable. Attackers can use it for reconnaissance ahead of a physical break-in. They can time deliveries and staff movements, or simply resell the access to someone else entirely.

Dahua camera security: what defenders should check

Dahua’s own security advisory, SA-2021-0130, has addressed both authentication bypass flaws since 2021. Current firmware closes the loopback and NetKeyboard tricks used in this campaign. The practical checklist for any organisation running this equipment is short but specific:

• Update firmware to a current release and confirm it through Dahua’s official channels, not a link forwarded by an installer.
• Audit accounts on every camera for unfamiliar entries, particularly anything resembling the p2pwn or p2password names seen in this campaign.
• Disable P2P or cloud relay features unless a specific business reason requires remote access through them.
• Change default credentials and remove unused accounts, including any left behind by an installer.
• Segment CCTV networks away from finance, HR and other sensitive systems, so a compromised camera cannot become a stepping stone.

None of that is exotic advice. It is the same hygiene that applies to any internet-facing device. Camera systems are frequently the ones nobody thinks to include in a patching schedule, because they sit outside the IT department’s usual remit. Where an internal review raises doubts, an IP camera penetration test can settle it, and confirm whether these gaps apply to your own estate before an attacker finds out first.