An exposed operator directory has revealed details of "Operation CameraSwarm," an attack that compromised over 14,000 Dahua cameras, primarily in Ukraine and Russia, between June 17 and July 22, 2026. The operation was reconstructed by Hunt.io researchers after their AttackCapture system discovered an open HTTP directory on a server at 154.86[.]119.60 on July 23, exposing 407 MB of the attacker's tools across 234 subdirectories.
The leaked files included the operator's scanning engine, exploit chains, an exfiltration bot, and a Windows stealer. Hunt.io's analysis indicates that the attacker utilized multiple methods to gain access. A brute-force engine targeted over 12,300 unique IP addresses. Additionally, an authentication-bypass chain, leveraging two Dahua vulnerabilities from 2021, installed a persistent backdoor account on 1,923 cameras. This backdoor account is designed to survive password changes and, on most firmware, factory resets.
A particularly concerning vector involved reaching 283 cameras solely through their serial numbers via Dahua's cloud relay, bypassing IP addresses entirely. This method exploits a design flaw where Dahua's cloud relay allows any application to connect to a camera behind NAT using only its serial number. Authentication to this relay relies on credentials identical across all Dahua clients. The attacker's logs suggest that 89.4% of live serial numbers exposed an open, unauthenticated channel. While gaining full admin access typically still requires credentials or an authentication bypass, the attacker's logs indicate that most exposed cameras did not require this final step. The device authenticates the session via a token issued by the cloud, which can be obtained using the fixed SDK credentials shared by legitimate Dahua applications.
The attacker's toolkit was not custom-built but rather assembled from various public repositories. Components like the brute-force engine, the bypass chain, the relay tooling, and a recovery-code generator were patched and rewritten, with Russian comments layered over Spanish code in some instances. The toolkit also includes a routine to recover stored device passwords by deriving decryption keys from device class prefixes and serial numbers, without needing a device secret.
One critical tool discovered is an offline recovery-code generator. Given a live serial number, this tool can derive a code offline that unlocks Dahua's cloud-level account-recovery flow, bypassing current credentials. This means that removing a backdoor account would not mitigate this specific vulnerability, which would require Dahua to alter how these codes are derived.
Hunt.io also found a UPX-packed Windows binary, identified as "SalatStealer," staged on the same server, alongside a PowerShell script designed to disable Windows Defender through five different methods, including a Group Policy key that persists across reboots and Defender updates. Researchers consider this a separate, unrelated capability sharing the same infrastructure, not directly part of the camera compromise campaign.
For users of Dahua equipment, or OEM-rebranded lines using the same backend (such as Amcrest, Lorex, Annke, and Swann), recommended actions include checking for and removing any "p2pwn" accounts, disabling P2P on unnecessary devices, confirming firmware is patched against the 2021 bypass vulnerabilities, and rotating all camera credentials, as the exfiltration bot reportedly captured them. However, these steps do not address the recovery-code vulnerability, which rests with the vendor.
It is important to note that the attacker's tools contained incorrect CVE references. The persistent backdoor technique was linked to CVE-2024-39943, which actually refers to a command-injection flaw in Rejetto's HTTP File Server. Similarly, the relay abuse was incorrectly associated with CVE-2025-31702, which Dahua describes as a narrower authenticated privilege-escalation flaw. These inaccuracies could mislead defenders searching for appropriate fixes.
