Operation CameraSwarm: Hackers Compromise 14,500+ Dahua Surveillance Devices via P2P Relays and Auth Bypasses
Executive Summary
Security researchers at Hunt.io have uncovered a widespread, automated cyber campaign codenamed Operation CameraSwarm (The Hacker News). Active between June 17 and July 22, 2026, the campaign successfully breached more than 14,530 Dahua IP cameras, Network Video Recorders (NVRs), and Digital Video Recorders (DVRs) worldwide. Threat actors weaponized a multi-stage intrusion toolkit combining credential attacks, legacy authentication bypass vulnerabilities, and automated Peer-to-Peer (P2P) relay techniques to establish persistent backdoor accounts that survive factory resets.
Deep-Dive Technical Analysis
Threat Actor Infrastructure & Toolkit Analysis
Researchers reconstructed Operation CameraSwarm from a 407 MB exposed working directory containing 2,616 files across 234 subdirectories, including exploit scripts, shell execution histories, target rosters, and campaign logs:
1. P2P Relay Exploitation (p2pwn): The attackers utilized a custom automated tool named p2pwn. Dahua devices feature a built-in cloud relay feature known as Easy4IP / P2P, which allows remote access without port forwarding. On vulnerable firmware versions, an attacker possessing a valid Dahua serial number can initiate a connection through Dahua's cloud relay before the camera performs its local authentication check, bypassing network NATs and perimeter firewalls.
2. Authentication Bypass Exploitation: For directly accessible devices, the toolkit automated exploitation of CVE-2021-33044 and CVE-2021-33045—flaws in the identity verification process during authentication handshakes that allow attackers to bypass login prompts.
3. Persistent Backdoor Account Injection: On at least 1,923 cameras, the toolkit automatically configured a covert administrative user account. Because this account was injected into internal configuration partitions, it reportedly survives standard web interface factory resets on several legacy firmware builds.
4. Credential Stuffing & Botnet Recruitment: The operation systematically sprayed default, weak, and leaked credential pairs against Dahua web interfaces across targeted subnets.
Geographic Impact & Espionage Tradecraft
* Geographic Concentration: Confirmed device takeovers were heavily concentrated in Eastern Europe (notably Ukraine and Russia), alongside commercial deployments across Western Europe and the Americas.
* Surveillance & Access Brokering: Threat actors harvested real-time RTSP video streams, extracted internal network routing tables from compromised NVRs, and packaged camera access credentials for transfer to third-party cybercrime channels.
Critical Infrastructure & Physical Security Risks
Compromising network surveillance infrastructure provides adversaries with physical and digital reconnaissance:
* Physical Espionage: Unrestricted live camera feeds reveal employee movements, security patrol routines, sensitive facility blueprints, and physical access controls.
* Internal Network Pivot: Modern IP cameras and NVRs are Linux-based network endpoints; compromising them grants adversaries an unmonitored foothold to scan internal subnets, intercept traffic, and pivot into corporate Active Directory environments.
Actionable Recommendations & Mitigations
1. Disable Cloud P2P / Easy4IP: Unless explicitly required for mobile operations, disable the P2P / Easy4IP feature within the device's web management interface (Settings > Network > P2P).
2. Apply Vendor Firmware Updates: Immediately download and apply the latest official firmware releases from the Dahua Security Center to resolve legacy authentication bypass flaws.
3. Audit Local User Accounts: Log into camera and NVR administration portals, inspect all configured user accounts, and delete unknown or default accounts (such as admin, guest, or custom installer names).
4. Network Segmentation: Place all video surveillance devices, NVRs, and IP cameras on a dedicated, non-routable Surveillance VLAN with no direct internet access, enforcing strict firewall rules for outbound connections.
5. Enforce Strong Credentials: Replace default passwords with complex, unique passphrases across all video endpoints.
________________
Sources & References: The Hacker News.