455/69 Friday, August 21, 2026
Researchers from threat intelligence company Hunt.io have disclosed a large-scale attack campaign named CameraSwarm, in which hackers compromised more than 14,500 Dahua IP cameras, most of them located in Ukraine and Russia. The campaign operated for at least 35 days, from June 17 to July 22, 2026, using multiple attack methods, including vulnerability exploitation, brute-forcing login credentials, and using offline recovery codes generated from the serial numbers of cameras registered to the cloud service. Hunt.io detected the campaign after finding an unprotected working directory on an HTTP server left exposed by the operators. Researchers were able to recover 407 MB of data, totaling 2,616 files across 234 directories, including source code, logs, credentials, captured camera images, shell history, and attack results.
Analysis found that CameraSwarm used three main attack methods. The first was brute-forcing devices over TCP port 37777, allowing access to devices from 12,324 unique IP addresses, capturing camera images, sending results to Telegram, and exporting data for use with Dahua’s SMART PSS platform. The second method used a tool named p2pwn to exploit CVE-2021-33044 and CVE-2021-33045, installing a persistent backdoor account named p2pwn / p2password on 1,923 cameras. This account remained in place even after password changes and, on most firmware versions, persisted after factory resets. The third method involved attacks through cloud relay access to reach 283 cameras behind NAT, using only serial numbers and SDK credentials embedded in Dahua applications. The data indicated that 89.4% of active serial numbers could be used to open an access channel without authentication.
Hunt.io stated that the recovery code generation in the attackers’ toolkit relied on camera serial numbers, allowing CameraSwarm operators to request new codes through Dahua’s standard password recovery process without knowing the current administrator password. Researchers found references to CVE-2024-39943 and CVE-2025-31702 in the tools, but did not observe them being used in the attacks analyzed. Hunt.io notified national CERTs and Dahua PSIRT on August 10, 2026. For administrators, Dahua cameras exposed on port 37777 during June and July should be considered potentially compromised and should be checked for the presence of the p2pwn account. Administrators should remove the account if found, disable P2P if not required, and update firmware according to Dahua advisory SA-2021-0130 for CVE-2021-33044 and CVE-2021-33045, or upgrade to a newer version. However, Hunt.io warned that removing the backdoor account does not invalidate recovery codes generated by the toolkit until Dahua strengthens the server-side code generation mechanism.