← News
/DISPATCH · 2026-08-20

Operation CameraSwarm: Triple-Path Attack Infects 14,530 Dahua IP Cameras; Hunt.io Extracts 407MB Attacker Toolkit, Reconstructs Full Kill Chain

Hunt.io on 19 August disclosed Operation CameraSwarm, a mass Dahua IP-camera compromise. 17 June–22 July: at least 14,530 devices fell to a combination of credential brute-force, CVE-2021-33044/33045 P2P exploits, and serial-number cloud relay. 1,923 received a reset-surviving `p2pwn` backdoor account; 283 were reached via P2P direct connect bypassing NAT.

Threat-intel firm Hunt.io on 19 August 2026 disclosed Operation CameraSwarm, a mass compromise of Dahua IP cameras. From 17 June through 22 July 2026—35 days—the operator scanned and penetrated public Dahua devices worldwide. 14,530 devices were confirmed compromised via three independent attack paths in combination: 12,324 unique IPs in TCP port 37777 credential-brute-force scope, 1,923 implanted with the p2pwn backdoor account, 283 reached via Dahua P2P relay bypassing NAT. Hunt.io submitted full IoCs and timeline to Dahua PSIRT and national CERTs on 10 August, and notes the campaign is not yet publicly attributed to a specific threat group or nation-state.

Incident Overview

Hunt.io reconstructed Operation CameraSwarm from a public HTTP server working directory with no access control: 2,616 files / 234 subdirectories / 407 MB total, covering source, runtime logs, leaked credentials, and exploit results. Further analysis showed the operator scanned the entire IPv4 space, starting with Russian address space then spreading globally; 89.4% of live serial numbers were found exposing an unauthenticated management channel. 1,923 cameras were pre-seeded with a backdoor account named p2pwn (password p2password) that, at firmware level, survives the vast majority of password changes and factory resets.

Three attack paths ran in parallel over 35 days. The port-37777 credential-brute-force system long-ran default/weak-password accounts, captured device snapshots, exfiled them over Telegram, and exported in Dahua SMART PSS platform format. The p2pwn tool exploited CVE-2021-33044 and CVE-2021-33045—two 2021 auth-bypass vulns—to load a persistent account. Cloud-relay attacks used only the device serial number plus Dahua SDK credentials to reach 283 cameras behind NAT. The toolkit also referenced two unused vulns, CVE-2024-39943 (Rejetto HFS command injection) and CVE-2025-31702 (Dahua privilege escalation requiring existing user credentials), indicating the operator kept alternate vectors in the kit that this campaign did not fire.

Technical Details

Impact Assessment

Dahua has long held a leading global video-surveillance market share. Affected models span consumer security, retail chains, city-scale public CCTV, and industrial sites. Operation CameraSwarm, via credential brute-force + old-CVE exploit + serial-number cloud relay in parallel, upgrades "cameras got hacked" into industrial camera ops: any of the 12,324 brute-forced IPs can serve as a lateral-movement pivot at the right time; 1,923 p2pwn backdoors survive reset, so traditional password change and device wipe do not eradicate them; 283 P2P-relay victims sit entirely behind NAT, so affected enterprises will struggle to see anomalous egress via border firewall policy. Hunt.io further notes the tooling can hand access to third parties, indicating victims may be stocked for resale as initial access broker (IAB) inventory.

From an OT / critical-infrastructure operator view: leaked public-camera feeds directly threaten privacy, retail security, and public-space order; PTZ-capable cameras can serve as mobile recon nodes; some cameras sit on power, water, and transport sites where the IT/OT boundary is already blurry. As of 19 August Dahua only told customers to update firmware; it has not issued a server-side patch for the P2P serial-number mechanism.

Remediation

References