A threat actor tracked as CameraSwarm compromised more than 14,530 Dahua IP cameras in just 35 days, using mass scanning, weak-password attacks, authentication bypasses, and cloud relay abuse.
Investigators found that 1,923 of the affected devices received a persistent backdoor account, potentially allowing attackers to regain access even after an administrator changes the main password.
The campaign ran between June 17 and July 22, 2026, and primarily targeted internet-exposed Dahua devices.
While scans covered global IP address ranges, confirmed compromises were concentrated in Ukraine and Russia, with the largest number of affected systems located in Ukraine. The campaign also hit networks in Mexico and Vietnam.
Researchers uncovered the operation after an attacker-operated server exposed an open HTTP directory.
The server contained 2,616 files across 234 folders, including scanning tools, exploitation utilities, stolen-camera records, scripts, and a separate Windows malware payload.
CameraSwarm Backdoors Dahua Cameras
CameraSwarm used several methods to reach Dahua cameras. Its brute-force engine targeted Dahua’s Easy4IP management service on TCP port 37777, recovering access to 12,324 unique IP addresses.
The tool tested credentials at scale and captured camera snapshots after successful logins. It reportedly sent successful credential results to a Telegram channel and saved images locally.
The operators also used authentication-bypass techniques associated with CVE-2021-33044 and CVE-2021-33045.
These flaws can allow unauthenticated administrative sessions on unpatched Dahua firmware by abusing trusted client types or spoofing a loopback address.
The campaign used the bypasses against 1,923 cameras before installing a new account named p2pwn with the password p2password.
This account is especially concerning because it is reportedly stored separately from the primary administrator password.
As a result, simply changing an admin password may not remove attacker access. On many affected firmware versions, the account may also survive a factory reset.
A third attack path abused Dahua’s P2P cloud relay service. The attackers could reach some cameras behind NAT using only a device serial number, without first knowing the target’s public IP address.
Their logs showed that 89.4% of live serial numbers tested returned an open channel that did not require authentication.
The exposed toolkit also included software capable of generating Dahua password-recovery codes offline for live devices.
These codes could provide administrative reset access without knowing the existing camera credentials, increasing the risk that access could be transferred or reused by other criminals.
Defenders should immediately review Dahua camera accounts for p2pwn, remove any unauthorized accounts, and rotate all device, ONVIF, NVR, and related network credentials.
Organizations should treat cameras exposed on TCP/37777 during the campaign period as potentially compromised, hunt.io said.
Indicators of Compromise
| Indicator | Type | Context / Detection Value |
|---|---|---|
154.86[.]119.60 | IPv4 address | Primary CameraSwarm operator server. It hosted an exposed directory containing scanning tools, Dahua exploitation utilities, campaign logs, and payload staging files. |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN-> Power your SOC with ANY.RUN
