Cybersecurity researchers have reported a campaign, identified as Operation CameraSwarm, that led to the compromise of more than 14,500 Dahua devices. The activity was observed between June and July 2026. The attackers reportedly leveraged a combination of credential-based attacks, specific authentication bypass vulnerabilities, and a peer-to-peer (P2P) relay method to achieve unauthorized access to these devices.
The initial vector for many compromises involved credential stuffing, where attackers attempt to log in using username and password pairs obtained from previous data breaches. This method relies on users reusing credentials across multiple services. In parallel, the campaign exploited two specific authentication bypass vulnerabilities, identified as CVE-2021-33044 and CVE-2021-33045. These types of flaws typically allow an attacker to circumvent the normal login process, gaining administrative access without valid credentials.
Once initial access was established, the attackers reportedly utilized a peer-to-peer (P2P) relay technique. P2P functionality in devices like network cameras often allows for remote access without complex network configurations, by routing traffic through an intermediary server. Attackers can exploit or misuse this feature to maintain persistence or expand their control over compromised devices, potentially bypassing traditional firewall rules.
The affected devices were primarily located in Ukraine and Russia. This geographical concentration suggests a targeted focus, though the specific motivation behind the campaign was not detailed in the report. Devices in this category, such as network video recorders (NVRs) and IP cameras, are frequently targeted due to their internet connectivity and the sensitive data they may handle or provide access to.
For users of Dahua devices, the primary mitigation advice includes updating device firmware to the latest available versions. Firmware updates often contain patches for known vulnerabilities, including authentication bypasses like those exploited in Operation CameraSwarm. Additionally, users are advised to disable P2P services on their devices if this functionality is not actively required for their operational needs, thereby removing a potential vector for remote access and control.
This incident underscores the persistent threat posed by a combination of common attack techniques. The use of credential stuffing highlights the importance of strong, unique passwords and multi-factor authentication where available. The exploitation of known vulnerabilities emphasizes the critical need for timely patching and regular security updates. Furthermore, the misuse of legitimate features like P2P services illustrates the broader challenge of securing internet-connected devices against sophisticated adversaries who can chain multiple attack methods.
