Researchers at Hunt.io shared details about a campaign they say affected more than 14,530 Dahua devices between June 17 and July 22, 2026. The activity has been codenamed Operation CameraSwarm and combines multiple attack paths: credential attacks, two authentication-bypass vulnerabilities and a peer-to-peer (P2P) relay technique.
What makes this case especially relevant for administrators is that the researchers were able to reconstruct the traces from a large, exposed “working directory” file package. At the same time, part of the exact counting figures remains tied to the campaign information contained in that material.
Operation CameraSwarm at a glance
Hunt.io says it was able to reconstruct the operation from an exposed working directory of 407 MB, containing 2,616 files spread across 234 subfolders. According to the researchers, the set included tooling, logs, shell history, and campaign data.
The researchers indicate that the confirmed compromises were primarily concentrated in Ukraine and Russia. The report does not name any recognized or publicly mentioned threat group driving the campaign, but it does point to evidence that the operator would be “Russian-speaking” based on language artifacts in the recovered material.
Three attack paths behind the compromises
According to Hunt.io, Operation CameraSwarm revolves around three main mechanisms. These involve different ways to gain access to a Dahua camera or a related device—sometimes via stolen or abused login credentials, sometimes by bypassing authentication, and sometimes through a relay path that can make devices behind NAT more reachable.
1) Credential attacks
Most of the activity is attributed by Hunt.io to credential attacks. In this case, the researchers say 12,324 unique IP addresses were linked to 13,229 campaign entries in the recovered records.
In practice, credential attacks often combine attempts, testing, and further rollout. In this campaign, the process appears to have been broad in terms of origin addresses.
2) Authentication bypass via two older CVEs
In addition, Hunt.io describes 1,923 cameras that were supposedly compromised via a PaaS-like route (meaning: a specific bypass route) using two authentication-bypass vulnerabilities: CVE-2021-33044 and CVE-2021-33045.
Hunt.io states that these two bypasses were also combined with a persistent account on the devices. Dahua qualifies these issues in its advisory with a CVSS score of 8.1, while the U.S. National Vulnerability Database (NVD) rates each vulnerability at CVSS 9.8.
Dahua indicates that attackers can bypass device-identity authentication by constructing malicious data packets.
- NetKeyboard as a client type would trigger CVE-2021-33044 during the authentication process.
- For CVE-2021-33045, there is a loopback-login request with the address 127.0.0.1, as also described in the original public disclosure by security researcher Bashis.
Important: as of August 19, 2026, both CVEs remain listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, with the recommendation to apply vendor mitigations or stop using the affected functionality if no mitigation is available.
3) P2P relay based on serial numbers
Finally, Hunt.io mentions a P2P relay route that, according to campaign data, was used to reach 283 cameras. This involved devices that could be identified by serial number, including devices “behind NAT”.
The core of the problem, according to ITRES Labs, is that the relay sets up a route without prior authentication. The system then hands off login checks to the device’s web application.
ITRES Labs also describes an earlier insight from incident response: on firmware before mid-2024, a valid Dahua serial number could be used to set up an Easy4IP relay path before the connected device itself reaches its credential-check. As a result, a device behind NAT could become reachable via the vendor relay infrastructure.
The publicly released material also references a proof-of-concept (“dh-p2p”) that searches for devices using Easy4IPCloud based on serial number and then can set up a tunnel toward the camera or network video recorder.
That said, a successful P2P relay makes a device reachable. This does not automatically mean that any additional access will work without device-level authentication; in practice, access often remains dependent on further checks.
What we do and don’t know about the numbers
For Operation CameraSwarm, Hunt.io reports campaign-specific totals of more than 14,530 affected devices, 1,923 persistent-account configurations, 283 P2P compromises, and a campaign claim that 89.4% of live serial numbers yielded an open channel without authentication.
ITRES Labs places caveats on some components. For example, ITRES Labs states that the public primary sources support the two older authentication-bypass vulnerabilities and the serial-number-based P2P mechanism, but do not independently confirm the specific campaign counts. In addition, the 89.4% figure is not described as reproducible by ITRES Labs in its supplementary testing work.
ITRES Labs also notes that some CVE labels attributed to tooling do not match the observed P2P behavior. For example, CVE-2024-39943 is described by the NVD as command injection in Rejetto HFS, and CVE-2025-31702 would be a privilege escalation issue that requires previously obtained normal user credentials.
Recommended actions for administrators
For organizations with Dahua cameras or related equipment, the message boils down to: patch, restrict external relay options, and clean up accounts.
Install fixes or newer firmware
Dahua advises installing the corresponding repair software or switching to newer firmware. Since the campaign explicitly ties itself to known authentication-bypass vulnerabilities, updating firmware promptly is a logical step and one of the most effective.
Disable P2P when you don’t need it
ITRES Labs recommends disabling P2P if it’s not required. If P2P is needed, the company advises limiting Easy4IP connectivity where appropriate.
In the context of Operation CameraSwarm, that step is especially meaningful: the relay route is designed to make a device reachable behind NAT via the relay path.
Use strong, unique credentials
Because credential attacks make up a large portion of the reported activity, it remains crucial to use strong, unique passwords—and not share login credentials across systems.
In addition, ITRES Labs highlights the importance of removing unused accounts.
Segmentation and control of video surveillance
Finally, it’s recommended to segment video surveillance systems. By not running cameras and NVRs “just anywhere” on the same network as office systems, you reduce the impact if a camera is compromised.
Why Operation CameraSwarm also matters beyond Dahua
Although the campaign specifically targets Dahua devices and known 2021 CVEs, Operation CameraSwarm shows a broader pattern we often see in IoT and video security environments. It’s not just one vulnerability, but a combination of:
- login paths and credential abuse;
- authentication processes that can be bypassed with specific payloads;
- connectivity mechanisms (such as relay or cloud P2P) that can bypass network restrictions.
This makes the topic relevant for organizations that manage cameras, access control, or other edge equipment: security is only complete when firmware management, account hygiene, and network policy come together.
Comparable context: real-world misuse of known weaknesses
If you want to see how quickly vulnerability exploitation in the wild can escalate, you can also look at earlier reports about actively exploited issues. For example: CISA: immediate patching of exploited vulnerabilities. Such updates align with the core principle that appears in almost every campaign: once vulnerabilities are listed in known catalogs or are already being exploited, patching must become a priority.
Conclusion
Operation CameraSwarm is an example of a campaign that uses multiple tracks at once to compromise Dahua cameras: credential attacks, authentication bypasses via CVE-2021-33044 and CVE-2021-33045, and a P2P relay technique based on serial numbers. Hunt.io links this to more than 14,530 compromises, but independent sources do not appear to fully confirm the exact numbers reported for the campaign.
For defenders, however, the key action perspective remains consistent: update firmware, disable P2P where possible, clean up credentials, and apply segmentation for video surveillance. This reduces both the likelihood of credential abuse and the impact of bypass and relay routes.
Source: https://thehackernews.com/2026/08/hackers-compromised-14500-dahua-devices.html
