Hackers compromise 14,500 Dahua web cameras in 35-day campaign

In a large-scale campaign that researchers dubbed CameraSwarm, hackers compromised more than 14,500 Dahua IP cameras mostly in Ukraine and Russia.

The operation ran for at least 35 days between June 17 and July 22, compromising devices by exploiting vulnerabilities, brute-forcing logins, and using offline recovery codes from serial numbers for cloud-registered cameras.

Researchers at threat intelligence company Hunt.io discovered the campaign after finding a working directory on an HTTP server that the operator left unprotected.

Hunt.io recovered 407 MB of data comprising 2,616 files across 234 directories, including source code, logs, credentials, captured camera images, shell history, and exploitation results, which helped them map an impressive operation.

CameraSwarm campaign overview

Source: Hunt.io

According to their findings, the 35-day CameraSwarm campaign compromised 14,530 Dahua IP cameras using three attack methods in parallel:

A brute-forcing system scanned TCP port 37777 and compromised devices at 12,324 unique IP addresses. It captured usable camera snapshots, sent results to Telegram, and exported them for Dahua’s SMART PSS platform. Exploiting CVE-2021-33044 and CVE-2021-33045 vulnerabilities using a tool called p2pwn that installed a persistent backdoor account (p2pwn / p2password) on 1,923 cameras. The account survives password changes and, on most firmware versions, factory resets. A cloud-relay attack reached 283 cameras behind NAT using only serial numbers and SDK credentials embedded in Dahua applications. Data indicates that 89.4% of live serials exposed an access channel without authentication.

The recovery code generation mechanism in the attack toolkit leverages the camera serial number, which allows the CameraSwarm operator to redeem new codes via Dahua’s standard password-recovery process without knowing the current admin password.

The researchers found two misleading vulnerability references in the toolkit, CVE-2024-39943 and CVE-2025-31702, which are not exploited in the observed attacks.

... continue reading