Operation CameraSwarm: Inside the Toolkit Behind 14,530 Compromised Dahua Cameras

Summary

Between 17 June and 22 July 2026, a single operator compromised more than 14,530 Dahua IP cameras and related devices, primarily concentrated in Ukraine and Russia. The campaign ran three exploitation paths at once: a credential brute-force engine against Dahua's Easy4IP management port, an authentication-bypass chain exploiting two 2021 vulnerabilities to plant a persistent backdoor account, and abuse of Dahua's cloud P2P relay to reach cameras behind NAT using nothing but a serial number.

Hunt.io recovered the operator's entire working environment, 2,616 files spanning 407 MB, after the operator exposed it through an open HTTP directory on their own staging server. The recovered toolkit shows a persistent backdoor left on 1,923 cameras, an offline recovery-code generator capable of granting transferable cloud-level administrative access by serial number alone, and a second, unrelated Windows credential stealer staged on the same host.

Background

The campaign was discovered on 23 July 2026, when Hunt.io's AttackCapture crawler flagged activity on TCP/37777, Dahua's Easy4IP binary management protocol, and pulled down the operator's own open directory. File timestamps and shell history reconstruct a five-week operation: reconnaissance and brute-forcing began 18 June, relay testing started a week later, the CVE-based bypass chain deployed on 12 July, and the largest scanning wave ran on 22 July, a day before the exposure was captured.

Scale is the defining feature of this operation: the brute-force engine alone reached 12,324 unique IP addresses, while the authentication-bypass chain planted a durable backdoor on nearly 1,900 devices. A separate serial-based relay path reached 283 additional cameras with no routable address and, per the operator's own logging, no credentials in the large majority of cases. The toolkit itself is not a single author's work; its components trace to at least six different upstream developers, assembled and progressively rewritten across three language layers, Spanish, Russian, and English, over the course of the campaign.

Vulnerability Details

Attack Methodology

1. 1. Internet-wide reconnaissance. masscan swept TCP/37777 in two phases, first against Russian address space at ten million packets per second, then across the full IPv4 range at a lower rate, filtered by a companion module that skipped CIDR blocks outside local business hours.
2. 2. Serial-number harvesting. A separate module queried Shodan with Dahua-specific banner strings and enumerated DDNS subdomains under dahuaddns.com and quickddns.com, building a target list of devices reachable by serial number rather than address.
3. 3. Credential brute-force. An asyncio-based engine, scaling from 300 to 4,000 concurrent workers, attempted default and weak credentials against port 37777 using a hand-built implementation of Dahua's Easy4IP login protocol, reaching 12,324 unique addresses.
4. 4. Authentication-bypass exploitation. Where brute-forcing failed, the p2pwn tool chained CVE-2021-33044 and CVE-2021-33045 to return a full administrator session in under a second against unpatched firmware, requiring no valid password.
5. 5. Persistent backdoor installation. After either bypass, p2pwn installed an account named p2pwn / p2password over RPC, stored independently of the admin password so it survives a password change and, on most firmware, a factory reset.
6. 6. P2P relay exploitation. A parallel toolkit abused Dahua's cloud relay at easy4ipcloud.com, using SDK credentials embedded in every legitimate Dahua client to reach cameras behind NAT by serial number alone, with roughly nine in ten live serials returning an open channel that required no authentication at all.
7. 7. Offline recovery-code generation. A separate module replicated Dahua's account-recovery flow entirely offline, deriving a transferable administrative recovery code for every live serial it verified, independent of the device's actual credentials.
8. 8. Exfiltration and enterprise packaging. Every successful credential hit and camera snapshot was posted immediately to a Telegram bot channel, while a separate export routine batched results into SMART PSS-compatible XML for bulk import into Dahua's own enterprise camera-management platform.

Indicators of Compromise (IOCs)

• ● 154.86[.]119.60
• ● 185.132[.]53.56
• ● easy4ipcloud[.]com:8800
• ● vk[.]com/wall-163997495
• ● dahuaddns[.]com
• ● quickddns[.]com
• ● rbc[.]ru

MITRE ATT&CK Mapping

Visual Attack Flow

Mitigation

1. 1. Audit and remove the p2pwn backdoor account. Any camera that was reachable on port 37777 between June and July 2026 should be checked for an account named p2pwn; removing it does not require a firmware update but must be done manually, since a factory reset alone will not clear it on most firmware.
2. 2. Disable P2P connectivity unless actively required. Because the relay routes across a pool of backend addresses rather than a single fixed server, address-based blocking does not reliably stop this path; disable P2P under the device's network settings where it is not in use.
3. 3. Apply Dahua's SA-2021-0130 patch. CVE-2021-33044 and CVE-2021-33045 have been fixed since October 2021; unpatched firmware can be fully compromised in under a second with no credentials, so port 37777 should also never be exposed directly to the internet.
4. 4. Update firmware to invalidate outstanding recovery codes. Dahua has confirmed that current firmware blocks generation of new offline recovery codes and periodically invalidates previously issued ones; until firmware is updated, treat any prior recovery code as a live risk independent of the backdoor account.
5. 5. Rotate all device credentials after remediation. Because the relay and bypass paths both expose stored credentials, including cached NVR passwords retrieved through the ONVIF lateral-movement step, assume any credential on an affected device was captured and rotate accordingly.
6. 6. Deploy detection for bypass-specific traffic patterns. Watch for login requests carrying a NetKeyboard client type or a loopback source address claim, and on Windows estates, monitor for bulk Defender exclusion paths, CIM-based policy queries, and unscheduled Group Policy refreshes.

Instantly Fix Risks with Saner Patch Management

Saner patch management is a continuous, automated, and integrated software that instantly fixes risks exploited in the wild. The software supports major operating systems like Windows, Linux, and macOS, as well as 550+ third-party applications.

It also allows you to set up a safe testing area to test patches before deploying them in a primary production environment. Saner patch management additionally supports a patch rollback feature in case of patch failure or a system malfunction.

Experience the fastest and most accurate patching software here.