Researchers at threat intelligence company Hunt.io report a campaign, dubbed Operation CameraSwarm, in which a single operator compromised more than 14,530 Dahua IP cameras between 17 June and 22 July 2026.
According to Hunt.io, the campaign came to light after the researchers crawled a fully open (unprotected) HTTP directory on a server used by the attacker, containing more than 2,600 files with tools, logs and records of the operation itself. Confirmed, geolocated compromises are concentrated mainly in Ukraine and Russia, with Ukraine accounting for the largest share. The scanning itself, however, was global and at certain points of the campaign also covered Mexican and Vietnamese networks.
Three parallel attack paths
- Password brute-force (port 37777): 12,324 unique IP addresses
- Authentication bypass (CVE-2021-33044 / CVE-2021-33045): 1,923 cameras, each with a backdoor installed
- P2P relay (serial number only): 283 cameras
Total unique devices: more than 14,530
1. Credential brute-force
A custom-written tool scans the internet for open port 37777 (Dahua's Easy4IP protocol) and then tries common username and password combinations at scale. On success, it takes a snapshot from the camera and automatically sends the result to a Telegram channel.
2. Authentication bypass (p2pwn)
A compiled Go tool exploits two old vulnerabilities, CVE-2021-33044 and CVE-2021-33045, which Dahua rates at CVSS 8.1 while NVD scores them at 9.8. Both remained in the CISA KEV (Known Exploited Vulnerabilities) catalog as of mid-August 2026. After a successful intrusion, a persistent backdoor account is created which, according to the researchers, survives a password change and, on most firmware versions, even a factory reset.
3. P2P relay through the Dahua cloud
This is the most unusual method: with nothing but a camera's serial number, no IP address and in most cases no login credentials, the attacker can reach a device behind NAT through Dahua's cloud relay infrastructure (easy4ipcloud.com). According to the operator's own records cited by Hunt.io, 89.4% of active serial numbers returned an open channel with no authentication required. The researchers also found a tool for generating access recovery codes offline, a capability they consider the strongest indicator that the toolkit was designed to hand access over to a third party.
An additional finding
The same server also hosted Windows malware entirely unrelated to the cameras (probably from the SalatStealer family), along with a script that disables Windows Defender in five different ways. According to the researchers, this points to preparation against a corporate rather than a home target.
Origin of the tools
According to the analysis, the entire toolkit is a compilation of other people's publicly available code: components borrowed from at least six different GitHub developers and gradually rewritten from Spanish, through a mixed version, to entirely Russian across three versions of the same file. The researchers assess the operators as Russian-speaking, but the campaign has not been attributed to any specific known group.
Protection recommendations
- Check the accounts on every Dahua camera for unknown users (in particular one named
p2pwn) and remove them - Disable the P2P/Easy4IP function unless it is actually needed
- Install the latest firmware from the manufacturer's official website (the fixes for CVE-2021-33044/33045 date from October 2021)
- Make sure port 37777 is not reachable from the internet
- Place video surveillance systems in a separate network segment
Appendix: what the p2pwn tool is
The Hunt.io report repeatedly mentions p2pwn, the tool the operator used to automate the attack. It is publicly available in the GitHub repository of user thebadinteger and is described by its author as a security scanner for Dahua cameras via P2P.
Technically, the Go-based tool combines several capabilities: brute-forcing weak passwords from a built-in list, automatically detecting and exploiting CVE-2021-33044 and CVE-2021-33045, capturing snapshots from the cameras, and generating XML files compatible with Dahua's management software (SMART PSS). It also includes a configurable option to add a persistent “dummy” account, by default with the username p2pwn and the password p2password. According to Hunt.io, this is precisely the backdoor account found on 1,923 compromised cameras in the CameraSwarm campaign.
The tool is licensed under GPL-3.0 and carries a notice that it is intended solely for educational purposes and authorized security testing. Hunt.io found, however, that the default configuration of the public code matches the settings the operator used in the campaign, an example of how a publicly available dual-use security tool can be turned to unauthorized attacks at scale. Publishing such a tool does not in itself imply any link between its author and a particular campaign.
The campaign in numbers
- Campaign period: 17 June – 22 July 2026
- Affected devices: more than 14,530
- Main vulnerabilities: CVE-2021-33044, CVE-2021-33045
A view from the field
Industry specialists in Bulgaria note that, in essence, the campaign exploits firmware from 2021 and earlier: devices that have not been updated since the fixes for CVE-2021-33044/33045 (October 2021), often combined with default or weak passwords and an enabled cloud P2P service (Easy4IP). On modern, regularly updated firmware these specific vectors are largely closed.
That does not remove the need for basic protection, though: in practice, the weakness lies as much in configuration and network architecture as in firmware. A reasonable minimum for any video surveillance installation includes:
- Network segmentation: the NVR and cameras are placed in a separate VLAN with no outbound route to the internet; remote access goes only through a VPN, never via port forwarding of 37777/554/80/443 to the WAN.
- P2P/cloud disabled: Easy4IP/P2P and UPnP are turned off on the devices and on the router, which closes exactly the relay vector that does not depend on the public IP address or the password.
- Credential hygiene: a unique, long password (12+ characters) on every device, default accounts removed and, where the hardware supports it, HTTPS for the web interface and two-factor authentication (2FA) for the administrator.
- Firmware management: the latest stable version is maintained, and EOL models that no longer receive patches are decommissioned, since they remain vulnerable forever.
- Account review: periodic checks of local users for unknown accounts (for example
p2pwn), logging of successful logins, and rate limiting/fail2ban in front of the web interface against brute-force attempts. - Traffic monitoring: alerts on unexpected outbound sessions from cameras to cloud relays, the Telegram API or unknown addresses, which are an early indicator of compromise.
In short: even if the “old” vulnerability is patched, a device with a public port, a default password or P2P enabled remains a target. Traffic should be monitored, the network segmented, and no part of the video surveillance system left directly visible from the internet.
