Researchers at Hunt.io report that a threat actor carried out a large-scale intrusion campaign against Dahua IP cameras. The activity, dubbed Operation CameraSwarm, resulted in thousands of camera compromises across Ukraine and Russia over a period of more than a month.
According to the analysis, attackers first used broad network scanning and later concentrated on Russian and CIS telecom ranges. After gaining access to exposed systems, they leveraged credential attacks, persistence mechanisms, and authentication bypass techniques to establish control over affected cameras.
What Operation CameraSwarm set out to do
Operation CameraSwarm ran between June 17 and July 22. The campaign started with global scanning that included ISP ranges associated with Russia, Mexico, and Vietnam. Over time, the focus narrowed toward Russian and Commonwealth of Independent States (CIS) telecom netblocks.
Hunt.io’s reporting indicates the actor used infrastructure that had been prepared well before the campaign began. The toolkit involved both original code and modified components attributed to multiple other developers, suggesting a flexible approach rather than a single-purpose, one-off script.
How the attackers gained access
In Hunt.io’s findings, analysts obtained access to server-side material tied to the threat actor. This included 2,616 files stored across 234 subdirectories, totaling roughly 407 MB of data. The data was left in an exposed HTTP directory, which allowed it to be retrieved and studied.
From that dataset, investigators concluded the campaign compromised over 14,530 devices during its 35-day window. A brute-force engine targeted 12,324 distinct addresses, indicating that a large part of the operation depended on repeatedly attempting credentials rather than exploiting a single, universal weakness.
A persistent RPC backdoor
Beyond simply taking over devices, Operation CameraSwarm also aimed to keep access. Hunt.io reports that the threat actor deployed a persistent backdoor account on 1,923 cameras using Remote Procedure Call (RPC).
The backdoor credentials use a specific username/password pair: p2pwn / p2password. Crucially, Hunt.io notes that this account is stored independently of the camera’s admin password. As a result, it can survive password changes and, on many firmware versions, also survive a factory reset.
This kind of persistence is particularly dangerous because it means typical “re-secure the device” steps may not remove the attacker’s access path.
Credential brute-forcing and automation
For the credential-guessing portion of the campaign, the operator used a publicly available asyncio-based framework. Automation of this type can accelerate attempts across many targets, helping the actor move quickly once exposed devices are found.
While scanning identified candidate cameras, the brute-force attempts were used to validate access and enable follow-on actions, including backdoor deployment.
Authentication bypass through chained vulnerabilities
Hunt.io also describes a compiled Go binary used to bypass authentication. The bypass process chained together multiple vulnerabilities, including CVE-2021-33044 and CVE-2021-33045, and a third CVE referenced as CVE-2024-39943.
In the report’s explanation, CVE-2021-33044 involves unconditional trust in how a client identifies as a NetKeyboard hardware controller. In that scenario, Hunt.io notes that when the clientType is NetKeyboard, the password field is not evaluated.
For CVE-2021-33045, the issue relates to how firmware reads the source address. Instead of relying on the TCP connection, the firmware is described as reading a claimed source address from the request body. By shaping requests accordingly, the attacker could reach a deeper access state.
According to Hunt.io, these bypasses can return a full administrator session without authentication. The binary then drops the backdoor account (p2pwn / p2password) via RPC.
Reaching cameras behind NAT using cloud relay
Not all targets would be directly reachable from the internet. In some cases, Hunt.io says attackers abused Dahua’s cloud relay to reach cameras that were located behind NAT (Network Address Translation).
Rather than requiring direct inbound connectivity, the actor used camera serial numbers to access devices through the relay mechanism. This extends the reach of the campaign beyond systems with open ports.
Evidence about intent and scope
Hunt.io emphasizes that the reporting does not establish the attacker’s ultimate motivation or intended end use for the compromised cameras. The observed behavior shows control and persistence, but the data analyzed does not conclusively reveal whether the devices were meant for surveillance, disruption, or other operational goals.
Additionally, Hunt.io assesses with moderate confidence that the toolkit was built to provide access to a third party. The assessment points to design traits such as a transferable recovery-code mechanism and an enterprise-format export pipeline. However, Hunt.io indicates that the evidence does not support a confirmed commercial operation.
Why Operation CameraSwarm matters for device security
Campaigns like Operation CameraSwarm illustrate how quickly IP camera ecosystems can become part of a larger cyber threat landscape. The combination of scanning, brute-force credential attempts, and persistence backdoors means that even when devices look “online,” attackers may have already established long-term control.
Importantly, the presence of a backdoor account that can outlive password resets raises the stakes for administrators. It also highlights that patching alone may not be sufficient if compromised firmware or configurations remain.
Practical takeaways for administrators
While this report focuses on what was observed, defenders can draw several lessons:
- Act on camera exposure quickly: if devices are reachable from the internet, reduce exposure and verify firewall policies.
- Review authentication hardening: weak credentials enable brute-force activity, especially when automation is used.
- Plan for persistence checks: if a backdoor account survives common recovery steps, administrators need a verification process beyond password changes.
- Monitor for unusual RPC behavior: persistence mechanisms often rely on specific management interfaces.
- Keep firmware updated: chained authentication bypasses often depend on known weaknesses addressed in newer releases.
Organizations that rely on IP cameras—whether for homes, retail, industrial sites, or public infrastructure—benefit from treating these systems as first-class security assets, not as “set-and-forget” hardware.
Conclusion
Operation CameraSwarm was a wide-ranging intrusion effort that compromised more than 14,000 Dahua IP cameras across Ukraine and Russia. Over a 35-day period, the threat actor blended large-scale scanning with brute-force attempts, deployed an RPC-based persistent backdoor, and used an authentication bypass chain to reach administrator sessions without standard credentials.
Even without confirmed details about the attacker’s final motivation, the operational pattern is clear: once attackers find accessible cameras, they work to maintain control and expand their reach through both direct and relay-based connectivity.
Source: https://www.securityweek.com/threat-actor-hacks-14000-ip-cameras-in-ukraine-and-russia/
