Hackers Compromised 14,500+ Dahua Devices Using Credential Attacks, Auth Bypasses, and P2P

Cybersecurity researchers at Hunt.io have disclosed a campaign, dubbed Operation CameraSwarm, that compromised more than 14,530 Dahua devices between June 17 and July 22, 2026. The operation used credential attacks, two authentication-bypass flaws (CVE-2021-33044 and CVE-2021-33045), and a peer-to-peer (P2P) relay technique. The findings were reconstructed from a 407 MB exposed working directory containing 2,616 files across 234 subdirectories, including tooling, logs, shell history, and campaign records. Confirmed compromises were concentrated in Ukraine and Russia.

Hunt.io attributed the compromises to three attack paths: credential attacks against 12,324 unique IP addresses, authentication bypass affecting 1,923 cameras (which were also configured with a persistent account), and P2P relay reaching 283 cameras identified by serial number, including devices behind NAT. The two 2021 flaws are authentication-bypass vulnerabilities in Dahua cameras, rated 8.1 on the CVSS scale by Dahua but 9.8 by NVD. Both remain listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog as of August 19, 2026.

The P2P path, separate from the auth bypasses, was previously documented by ITRES Labs. On firmware before mid-2024, a valid Dahua serial number could establish an Easy4IP relay path before device authentication, making devices behind NAT reachable. Hunt.io reported that 89.4% of live serial numbers returned an open channel without authentication, though this figure remains a campaign-specific claim not independently reproduced.

Two other CVEs associated with the recovered tooling do not describe the P2P behavior: CVE-2024-39943 (Rejetto HFS command injection) and CVE-2025-31702 (Dahua privilege escalation). ITRES Labs described the serial-number relay exposure as a non-CVE issue and noted that firmware released after mid-2024 reinforced the P2P path. Defenders are advised to disable P2P unless required, restrict Easy4IP connectivity, update firmware from the vendor, use strong unique credentials, remove unused accounts, and segment video surveillance systems. The operator is described as Russian-speaking based on language artifacts, but no named threat actor has been attributed.