A campaign dubbed "CameraSwarm" compromised over 14,500 Dahua IP cameras, primarily in Ukraine and Russia, over a 35-day period between June 17 and July 22. Threat intelligence company Hunt.io discovered the operation after finding an unprotected HTTP server containing 407 MB of data, including source code, logs, credentials, and captured camera images.
The attackers employed three distinct methods to compromise devices. The most prevalent method involved a brute-forcing system that scanned TCP port 37777, leading to the compromise of cameras at 12,324 unique IP addresses. This system captured snapshots, sent results to Telegram, and exported them for Dahua's SMART PSS platform.
Another method exploited CVE-2021-33044 and CVE-2021-33045 using a tool called "p2pwn." This resulted in the installation of a persistent backdoor account, also named "p2pwn" with the password "p2password," on 1,923 cameras. This backdoor account is designed to survive password changes and, on most firmware versions, factory resets.
The third attack vector was a cloud-relay attack, which targeted 283 cameras located behind NAT. This method leveraged only serial numbers and SDK credentials embedded in Dahua applications. Data indicated that 89.4% of live serial numbers exposed an access channel without requiring authentication. The attack toolkit's recovery code generation mechanism utilized the camera's serial number, enabling the operator to obtain new codes through Dahua's standard password recovery process without needing the current administrator password.
Hunt.io's analysis revealed that the scanning operations were global, initially focusing on the Russian address space before expanding to the entire IPv4 range. The operator's primary focus, however, appeared to be on Russian and CIS telecom netblocks. Researchers also noted the presence of Russian comments within modified code sections of repurposed public tools.
On August 10, Hunt.io informed national CERTs and Dahua's PSIRT about the CameraSwarm campaign. Dahua cameras accessible via port 37777 during the June-July period should be considered potentially compromised. Owners are advised to check for the "p2pwn" account and remove it.
However, Hunt.io warns that simply removing the backdoor account will not invalidate recovery codes generated by the toolkit, as these codes remain usable until Dahua modifies the derivation process on its servers. Users are also recommended to disable P2P functionality when it is not needed and to apply Dahua SA-2021-0130 firmware updates, or a later version, to address CVE-2021-33044 and CVE-2021-33045. The researchers also found two unexploited CVE references, CVE-2024-39943 and CVE-2025-31702, in the toolkit.
