Operation CameraSwarm Compromises Over 14,500 Dahua Devices
A campaign dubbed Operation CameraSwarm exploited credential stuffing, authentication bypass flaws, and a P2P relay technique to compromise more than 14,530 Dahua devices.
Researchers at Hunt.io have detailed a significant cyber campaign, codenamed Operation CameraSwarm, which successfully compromised over 14,530 Dahua devices between June 17 and July 22, 2026. The attackers employed a multi-pronged approach, utilizing credential stuffing, two specific authentication-bypass vulnerabilities (CVE-2021-33044 and CVE-2021-33045), and a peer-to-peer (P2P) relay technique to gain unauthorized access. The campaign's scope was revealed through an exposed working directory containing extensive tooling, logs, and campaign records, with confirmed compromises primarily concentrated in Ukraine and Russia.
The attackers leveraged three distinct methods to achieve these compromises. Credential stuffing was the most prolific, accounting for 13,229 campaign records across 12,324 unique IP addresses. A significant number of devices, 1,923 cameras, were compromised by exploiting the aforementioned authentication bypass flaws, CVE-2021-33044 and CVE-2021-33045. These vulnerabilities, rated with high CVSS scores (8.1 by Dahua and 9.8 by NVD), allow attackers to bypass device identity authentication by sending malicious data packets. A further 283 cameras were compromised via a P2P relay technique, identified by their serial numbers and enabling access even for devices located behind network address translation (NAT).
The two authentication bypass vulnerabilities, CVE-2021-33044 and CVE-2021-33045, have been known since 2021. CVE-2021-33044 is triggered by a NetKeyboard client type during authentication, while CVE-2021-33045 involves a loopback login request. Despite being disclosed years ago, both vulnerabilities remain listed in CISA's Known Exploited Vulnerabilities (KEV) catalog as of August 19, 2026, underscoring the persistent threat they pose to unpatched Dahua devices. Dahua's advisories recommend installing updated firmware, while CISA advises applying vendor mitigations or discontinuing use if mitigations are unavailable.
The P2P relay technique, while separate from the CVEs, also presents a significant risk. Researchers found that on firmware versions prior to mid-2024, a valid Dahua serial number could be used to establish an Easy4IP relay path. This allowed attackers to connect to devices behind NAT without requiring initial device-level authentication, as the login checks were deferred to the device's web application. The p2pwn repository further confirms this mechanism, showing that the Dahua P2P protocol can locate devices via Easy4IPCloud using their serial number and establish a tunnel.
Hunt.io reported that 89.4% of live serial numbers examined in the operator's recovered code returned an open channel without authentication. However, this specific figure remains a campaign-specific claim from the recovered operator material and has not been independently reproduced by other security entities. ITRES Labs, who investigated a similar P2P relay exposure in earlier incidents, described this as a non-CVE issue and noted that Dahua reinforced the P2P path in firmware released after mid-2024.
Two other CVE labels were associated with the recovered tooling but do not directly describe the P2P behavior: CVE-2024-39943 is an OS command injection flaw in Rejetto HFS, and CVE-2025-31702 is a privilege escalation flaw in Dahua products that requires prior normal-user credentials. These appear to be secondary tools or misattributions within the attacker's toolkit.
Defenders are strongly advised to disable P2P functionality on Dahua devices unless absolutely necessary, restrict Easy4IP connectivity, and ensure devices are updated with the latest firmware from the vendor's official website. Additional recommendations include using strong, unique credentials, removing any unused accounts, and segmenting video surveillance systems from critical networks. Dahua has directed customers to install repair software or newer firmware to address these issues.
The operator behind Operation CameraSwarm is believed to be Russian-speaking, based on language artifacts found in the recovered directory. However, the campaign has not been officially attributed to a specific named threat actor, government entity, or known group. Hunt.io assessed with moderate confidence that parts of the toolkit might have been designed for transferring camera access to third parties, suggesting a potential for further exploitation or sale of compromised devices.