Full research report

Hackers compromise 14,500 Dahua web cameras in 35-day campaign

Original reporting ↗
★ Threat intelligence assessment high confidence

Executive assessment

CameraSwarm is an unusually well-documented campaign because the operator left a fully accessible working directory on their server, enabling Hunt.io to reconstruct 35 days of activity with forensic precision. The exploitation of CVE-2021-33044 and CVE-2021-33045 — both CVSS 9.8 authentication bypasses patched in October 2021 and added to CISA KEV in August 2024 — against cameras still unpatched in mid-2026 underscores the chronic patching gap in surveillance device fleets. The p2pwn backdoor account is particularly persistent: it survives password resets and, in most firmware versions, factory resets, and the serial-number-derived recovery codes remain valid until Dahua changes server-side derivation — a change not confirmed as of disclosure. The geographic focus on Ukrainian and CIS surveillance infrastructure, Russian-language code artefacts, targeting of eastern Ukrainian city names, and infrastructure hosted on an OFAC-sanctioned provider collectively suggest an intelligence-collection motive, though formal attribution to a state actor has not been established. The staging of SalatStealer on campaign infrastructure indicates the operator may pursue credential harvesting beyond camera access.

What happened

Between 17 June and 22 July 2026, an unknown Russian-speaking operator ran a 35-day campaign dubbed CameraSwarm that compromised 14,530 Dahua IP cameras, primarily in Ukraine and Russia. Hunt.io reconstructed the full operation after discovering an unprotected working directory on the operator's server containing 407 MB of source code, logs, credentials, captured images, and exploitation results. The campaign was disclosed publicly on 18–19 August 2026, following Hunt.io's notification of national CERTs and Dahua's Product Security Incident Response Team (PSIRT) on 10 August 2026. The operator's targeting pattern — beginning with Russian address space before settling on Russian and CIS telecom netblocks, combined with Russian-language code artefacts and geographic focus on eastern Ukrainian cities — suggests an intelligence-collection intent, though no attribution to a named threat actor or state entity has been made.

Affected scope

Dahua IP cameras, network video recorders (NVRs), digital video recorders (XVRs), PTZ dome cameras, thermal cameras, and video intercoms running firmware predating Dahua advisory SA-2021-0130 (pre-June 2021 for CVE-2021-33044; pre-mid-2020 for CVE-2021-33045). Devices reachable on TCP port 37777 or enrolled in Dahua's P2P cloud relay service are at highest risk. The campaign's primary geographic concentration was Ukraine and Russia, with the dominant compromised model identified as DH-IPC-K35P. Any Dahua camera reachable on port 37777 between June and July 2026 should be treated as potentially compromised pending investigation.

Technical assessment

The campaign employed three parallel access paths. The primary vector used an asyncio-based brute-force scanner (asleep_scanner) capable of 4,000 concurrent workers to target TCP port 37777, compromising 12,324 unique IP addresses with weak or default credentials. The second vector exploited CVE-2021-33044 and CVE-2021-33045 via a Go binary called p2pwn that chains two authentication bypass flaws — one abusing the NetKeyboard client type, one using loopback source-address spoofing — to install a persistent backdoor account (p2pwn/p2password) that survives password changes and, on most firmware versions, factory resets. The third vector abused Dahua's P2P cloud relay (easy4ipcloud.com:8800), using only device serial numbers and SDK credentials to reach 283 cameras behind NAT, with 89.4% of live serials returning an unauthenticated access channel. The operator's toolkit also staged SalatStealer on campaign infrastructure, a credential and cryptocurrency stealer indicating potential broader targeting beyond cameras. Two CVE identifiers found in the toolkit (CVE-2024-39943 and CVE-2025-31702) were confirmed by Hunt.io to be mislabelled and were not exploited in the observed attacks.

Recommended defensive actions

  1. Audit all Dahua cameras reachable on TCP port 37777 for the presence of a 'p2pwn' account and remove it immediately; treat any device reachable on this port between June and July 2026 as compromised pending full investigation
  2. Apply Dahua SA-2021-0130 firmware updates for CVE-2021-33044 and CVE-2021-33045, or upgrade to the latest available firmware release, as unpatched devices can be bypassed without any credentials in under one second
  3. Disable P2P/cloud relay functionality in camera settings (Settings → Network) unless operationally required, as serial-number enumeration alone provides unauthenticated access to enrolled devices
  4. Rotate all camera credentials and any credentials stored on or captured from potentially compromised devices; note that backdoor recovery codes generated by the campaign toolkit remain valid until Dahua alters server-side derivation
  5. Monitor for login attempts on port 37777 containing 'clientType: NetKeyboard' or 'loginType: Loopback' with source IP 127.0.0.1 as network-level indicators of CVE exploitation
  6. Segment camera networks behind a dedicated VLAN and block TCP port 37777 from direct internet exposure and from workstation network segments

Uncertainties and evidence gaps

  • Recovery codes generated by the campaign toolkit remain valid until Dahua alters server-side derivation; it is not publicly confirmed whether Dahua has implemented this change following the August 2026 disclosure
  • The campaign has not been attributed to a named threat actor, APT group, or state-sponsored entity; Russian-language artefacts and targeting of eastern Ukrainian surveillance infrastructure are consistent with intelligence collection but do not confirm state direction
  • The full downstream impact of SalatStealer deployment on campaign infrastructure and any credential theft beyond camera access is unknown from published evidence
  • CVE-2025-31702's precise scope in relation to the unauthenticated P2P relay abuse documented in this campaign remains unclear; it is uncertain whether the broader relay vulnerability has a separate assigned CVE

Vulnerability flow

Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.

AccessNetwork access to TCP port 37777 on an unpatched Dahua device; no credentials required for the authentication bypass paths; serial number alone sufficient for the P2P relay path
ComponentDahua firmware authentication handler (login process) and Dahua P2P cloud relay service (easy4ipcloud.com:8800)
MechanismImproper authentication validation (CWE-287): the firmware incorrectly trusts attacker-supplied client-type and source-address parameters during the login handshake, allowing the authentication requirement to be bypassed entirely without valid credentials
ImpactUnauthenticated administrative access enabling persistent backdoor account creation, live camera feed access, credential harvest, and potential lateral movement if surveillance networks are not segmented from operational systems
DetectionLogin requests on port 37777 containing 'clientType: NetKeyboard' or 'loginType: Loopback' with loopback source address; presence of user account named 'p2pwn' in camera user lists; outbound connections to easy4ipcloud.com:8800 from cameras not intentionally enrolled in P2P
MitigationApply Dahua SA-2021-0130 firmware patch or any subsequent firmware release; disable P2P relay; restrict TCP port 37777 to trusted management networks only
Exploitation status

Confirmed active exploitation in the CameraSwarm campaign (June–July 2026) via the p2pwn tool chaining both CVEs; CVE-2021-33044 and CVE-2021-33045 were previously added to the CISA Known Exploited Vulnerabilities catalogue on 21 August 2024, with public proof-of-concept code available since October 2021.

Research process

The investigation began with the BleepingComputer report and source material listing four CVEs, two of which were confirmed in the CISA Known Exploited Vulnerabilities catalogue. The Hunt.io primary and secondary blog posts — both fetched directly — provided forensic reconstruction of the full campaign from 407 MB of recovered operator data, resolving all key technical questions. Independent corroboration came from The Hacker News and two government sources (SecurityWeek/CISA and CSA Singapore). NVD records verified CVSS scores and affected product ranges for both actively exploited CVEs. Across six independently verified source domains, the evidence base is sufficient for a high-confidence assessment.

  1. What does the primary news report claim about the campaign, the CVEs, and which vulnerabilities were actually exploited?
    Fetched BleepingComputer article covering the CameraSwarm campaign
    bleepingcomputer.com ↗

    Confirmed 14,530 cameras compromised via three methods over 35 days; CVE-2021-33044 and CVE-2021-33045 exploited via p2pwn tool; CVE-2024-39943 and CVE-2025-31702 present in toolkit but confirmed not exploited; backdoor p2pwn/p2password survives factory resets on most firmware

    why Established the full claim set requiring verification and identified Hunt.io as the primary research source to validate

  2. Where is the original Hunt.io research published, and is there independent editorial corroboration?
    Searched for Hunt.io CameraSwarm blog post and broader media coverage

    Located Hunt.io primary post (operation-cameraswarm) and a second Hunt.io post (russian-speaking-operator-ukrainian-camera-toolkit), plus The Hacker News as an independent outlet; multiple secondary aggregators consistent with primary reporting

    why Identified the authoritative primary source and confirmed independent editorial coverage across distinct domains

  3. What are the confirmed CVSS scores, affected product ranges, and technical mechanism for CVE-2021-33044 and CVE-2021-33045?
    Searched for CVE technical details and PoC availability

    Both CVEs carry CVSS 9.8 Critical, CWE-287 improper authentication; CVE-2021-33044 affects pre-June 2021 firmware via NetKeyboard type argument; CVE-2021-33045 extends to NVRs and XVRs via loopback address spoofing; public PoC available since October 2021 via full-disclosure

    why Confirmed severity and scope; established that devices unpatched for five years remain the vulnerable population, explaining the campaign's scale

  4. What forensic detail does the Hunt.io primary post add beyond the BleepingComputer summary?
    Fetched Hunt.io primary CameraSwarm blog post
    hunt.io ↗

    Full attacker infrastructure (IPs 154.86.119.60 and 185.132.53.56, DDNS domains), asyncio scanner technical specifications (4,000 concurrent workers, lockout detection), p2pwn described as Go binary chaining both CVEs, SalatStealer staging confirmed, day-by-day campaign timeline, CVE-2024-39943 confirmed as unrelated HFS vulnerability mislabelled in toolkit

    why Primary forensic source with evidence from recovered operator data; resolves all key factual questions and provides actionable IoCs

  5. Do NVD records independently confirm the CVE descriptions and affected product scope?
    Fetched NVD detail pages for CVE-2021-33044 and CVE-2021-33045
    nvd.nist.gov ↗

    NVD confirms CVSS 9.8, CWE-287 for both; affected models span IP cameras, intercoms, PTZ cameras, thermal cameras, NVRs, and XVRs; CISA KEV addition confirmed at 2024-08-21 with federal due date 2024-09-11

    why Authoritative government record independently verifies severity; CISA KEV entry confirms prior wild exploitation and mandatory federal remediation, strengthening the active exploitation assessment

  6. Does The Hacker News reporting add independent detail or contradict Hunt.io's findings?
    Fetched The Hacker News article on the CameraSwarm campaign
    thehackernews.com ↗

    Fully consistent with Hunt.io findings; confirms 14,530 devices, three attack vectors, CVE-2021-33044/33045 exploitation, and Russian-speaking operator assessment; no contradictions identified

    why Provides independent corroboration from a separate editorial outlet, satisfying the two-source verification requirement

  7. What does the Hunt.io secondary post reveal about the threat actor, toolkit, and geographic targeting?
    Fetched Hunt.io secondary blog post on Russian-speaking operator toolkit
    hunt.io ↗

    Infrastructure hosted on Aeza Group LLC (AS210644, OFAC-sanctioned July 2025); second operator on Latvian infrastructure; toolkit targets specific eastern Ukrainian cities (Dobropillia, Kramatorsk, Slavyansk); broader toolkit includes SQL injection and router exploitation scripts; Russification of originally Spanish-language code provides attribution evidence

    why Strengthens the intelligence-collection hypothesis; OFAC-sanctioned hosting and targeting of conflict-zone cities are material context for defenders assessing campaign intent

  8. Do government advisories independently verify the CISA KEV status and patch guidance for Dahua SA-2021-0130?
    Fetched SecurityWeek CISA warning article and CSA Singapore advisory
    securityweek.com ↗

    SecurityWeek confirms CISA KEV addition 2024-08-21 with federal deadline 2024-09-11; CSA Singapore independently confirms affected product lines and patch recommendation; both sources consistently reference Dahua SA-2021-0130 as the primary remediation

    why Third and fourth independent source domains complete the evidence base; government-level corroboration across two jurisdictions supports high-confidence rating

Named in this story
ActorsUnknown Russian-speaking operator (unattributed to any named group or state entity)d34db33f-1007 (author of asleep_scanner asyncio brute-force engine)
Malwarep2pwn (Go binary backdoor account installer chaining CVE-2021-33044 and CVE-2021-33045)SalatStealer (UPX-packed Windows credential and cryptocurrency stealer staged on campaign infrastructure)asleep_scanner (asyncio brute-force engine, up to 4,000 concurrent workers)
TargetsDahua IP cameras in Ukraine and RussiaEastern Ukrainian cities: Dobropillia, Kramatorsk, SlavyanskRussian and CIS telecom netblocksGlobal IPv4 address space (initial reconnaissance phase)
Related CVEs CVE-2021-33044CVE-2021-33045

Research coverage

All 68 registered source leaves were evaluated for this run: 58 completed, 0 were unavailable, 3 failed and 7 were disabled. For this story, 3 registered sources supplied useful evidence (2 primary, 0 corroborating, 1 contextual and 0 PoC/exploit references). 55 completed sources contained no matched information for this story.

Primary evidence Independent corroboration Operational context PoC reference Checked — no match Unavailable Failed Disabled
Complete source-by-source audit 68 sources
SourceRun resultValueWhy it was useful — or not
BleepingComputernews ok12 records Primary evidence2 matched items Published the source report used to frame and date the event. Supplied independent analysis opened and verified during focused research.
CISA KEVkev ok1671 records Primary evidence2 matched items Confirmed that a related CVE is listed in CISA's Known Exploited Vulnerabilities catalogue.
FIRST EPSSepss ok7807 records Context2 matched items Added exploitation-probability context; EPSS does not itself prove exploitation.
AlienVault OTXdark_web failed0 records Failed The current collection attempt failed; this source cannot support the report.
CIRCL CVEcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
CISA Alertsnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Cisco PSIRTvendor_advisory stale fallback0 records Failed The current collection attempt failed; this source cannot support the report.
Cisco Talosnews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI CVE most exploiteddeepdarkcti ok94 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Discorddeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI exploitsdeepdarkcti ok24 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI forumsdeepdarkcti ok264 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware as a servicedeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware samplesdeepdarkcti ok3 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI marketsdeepdarkcti ok127 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI phishingdeepdarkcti ok19 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI ransomware gangsdeepdarkcti ok685 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI RATsdeepdarkcti ok1 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram infostealerdeepdarkcti ok130 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram threat actorsdeepdarkcti ok1009 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Twitter threat actorsdeepdarkcti ok39 records Checked — no match The source completed, but none of its retained records matched this story.
DNSDumpster domain IOC enrichmentresearch ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Exploit-DBexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Fortinet PSIRTvendor_advisory disabled Disabled Disabled in the source registry; no check was attempted.
GitHub topic: cveresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: exploitresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: penetration-testingresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: pocresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: vulnerabilityresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GreyNoiseexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
KrebsOnSecuritynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
LinkedIn RSS proxy feeds (disabled)research disabled Disabled Disabled in the source registry; no check was attempted.
MalwareBazaardark_web ok3 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cveresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cybersecurityresearch ok17 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #exploitresearch ok10 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #infosecresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #malwareresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #ransomwareresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #threatintelresearch ok12 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #vulnerabilityresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Metasploit module metadataexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Microsoft MSRCvendor_advisory ok1590 records Checked — no match The source completed, but none of its retained records matched this story.
Microsoft Securitynews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
MISP Galaxyresearch ok1 records Checked — no match The source completed, but none of its retained records matched this story.
MISP threat actor galaxyactor ok0 records Checked — no match The source completed, but none of its retained records matched this story.
NVDcve failed0 records Failed2 matched items The current collection attempt failed; this source cannot support the report.
Palo Alto Networks PSIRTvendor_advisory ok25 records Checked — no match The source completed, but none of its retained records matched this story.
ProjectDiscovery nuclei templatesexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Rapid7news ok2 records Checked — no match The source completed, but none of its retained records matched this story.
Reddit r/AskNetsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/cybersecurity (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/malware (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/netsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/ReverseEngineering (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
SANS ISCnews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Shadowserver public aggregate honeypot observationsexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Shodanresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sigma Rulesresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sophos IOCsresearch ok1 records Checked — no match The source completed, but none of its retained records matched this story.
The Hacker Newsnews ok9 records Checked — no match The source completed, but none of its retained records matched this story.
ThreatFoxthreat_intelligence ok100 records Checked — no match The source completed, but none of its retained records matched this story.
UK NCSCnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Unit42 IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
URLhausdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
VirusTotal Community IOC enrichmentresearch ok4 records Checked — no match The source completed, but none of its retained records matched this story.
VulnCheck KEVkev ok500 records Checked — no match The source completed, but none of its retained records matched this story.
Vulnerability Lookupcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
Additional verified pages 5 opened outside the registered collection
References & evidence
Vulnerability & exploitation4
CVE-2021-33045 CISA KEV Dahua IP Camera Firmware · added 2024-08-21 CISA catalog ↗
CVE-2021-33044 CISA KEV Dahua IP Camera Firmware · added 2024-08-21 CISA catalog ↗
CVE-2021-33044 EPSS 99.9% 100th percentile exploitation probability
CVE-2021-33045 EPSS 99.6% 100th percentile exploitation probability
PoC & exploit code1
Operation CameraSwarm: Over 14,000 Dahua cameras compromised across Ukraine and Russia hunt.io ↗

Primary technical write-up by Hunt.io; details the p2pwn Go binary chaining CVE-2021-33044 and CVE-2021-33045 to install a persistent backdoor account

Vendor & gov advisories2
CISA Warns of Exploited Vulnerabilities Impacting Dahua Products — SecurityWeek securityweek.com ↗

Covers CISA KEV addition of both CVEs on 21 August 2024 with federal remediation deadline of 11 September 2024

Vulnerabilities in Dahua's Cameras — Cyber Security Agency of Singapore csa.gov.sg ↗

Independent government advisory confirming affected product lines and recommending immediate firmware upgrade to Dahua SA-2021-0130

Analysis & research6
Operation CameraSwarm: Over 14,000 Dahua cameras compromised across Ukraine and Russia hunt.io ↗

Primary forensic research reconstructed from 407 MB of recovered operator data; covers tools, infrastructure, IoCs, and full timeline

Inside a Russian-Speaking Operator's Ukrainian IP Camera Toolkit hunt.io ↗

Hunt.io secondary post detailing threat actor toolkit, eastern Ukrainian city targeting, SalatStealer staging, and OFAC-sanctioned hosting provider

Hackers compromise 14,500 Dahua web cameras in 35-day campaign — BleepingComputer bleepingcomputer.com ↗

Corroborating report with additional mitigation guidance including p2pwn account removal steps

Hackers Compromised 14,500+ Dahua Devices Using Credential Attacks, Auth Bypasses, and P2P — The Hacker News thehackernews.com ↗

Independent editorial corroboration consistent with Hunt.io findings; confirms Russian-speaking operator assessment

CVE-2021-33044 Detail — NVD nvd.nist.gov ↗

Authoritative CVSS 9.8 Critical rating, CWE-287 classification, and CISA KEV confirmation

CVE-2021-33045 Detail — NVD nvd.nist.gov ↗

Extends affected scope to NVRs and XVRs not fully covered by CVE-2021-33044; same CVSS 9.8 Critical rating