In a large-scale campaign that researchers dubbed CameraSwarm, hackers compromised more than 14,500 Dahua IP cameras mostly in Ukraine and Russia.

An exposed operator directory reveals how one actor compromised 14,000+ Dahua cameras across Ukraine and Russia, no password needed for most.

Researchers at Hunt.io uncovered "Operation CameraSwarm," a mass-hacking campaign that compromised over 14,530 Dahua IP cameras in Ukraine and Russia between June 17 and July 22. The attacker exploite

Operation CameraSwarm targeted Dahua cameras across multiple countries, focusing on Russian and CIS telecom netblocks.

In a large-scale campaign that researchers dubbed CameraSwarm, hackers compromised more than 14,500 Dahua IP cameras mostly in Ukraine and Russia.

In a large-scale campaign that researchers dubbed CameraSwarm, hackers compromised more than 14,500 Dahua IP cameras mostly in Ukraine and Russia.

An exposed working directory on an open HTTP server revealed details of a campaign targeting Dahua cameras. The operation used three exploitation methods: an asyncio credential brute-forcer, a CVE-2021-33044/33045 authentication-bypass chain, and P2P relay abuse via serial numbers without proper authentication. Two referenced CVEs (2024-39943 and 2025-31702) were mislabeled or unrelated to the unauthenticated relay abuse. The corpus provided technical details, including PTCP tunnel techniques, but did not attribute the attack to any specific actor.

CameraSwarm-niminen uhka-aktori kompromissoi yli 14 530 Dahua IP-kameraa vain 35 päivässä käyttäen massiivista skannausta, heikkojen salasanojen hyökkäyksiä, todentamisen kiertämistä ja pilvipalvelun välityspalvelujen väärinkäyttöä. Tutkijat havaitsivat, että 1 923 vaikuttuneista laitteista sai pysyvän takaoven-tilin, mikä saattaa antaa hyökkääjille mahdollisuuden saada uudelleen pääsyn jopa sen jälkeen, kun järjestelmänvalvoja vaihtaa pääsalasanan. […] Artikkeli CameraSwarm Hackers Compromise 14,500+ Dahua Cameras, Backdoor 1,900 Devices ilmestyi ensin osoitteessa Cyber Security News.

At a Glance Actor A single unattributed operator (Russian-language code comments observed) Activity Mass compromise of Dahua IP cameras via brute-force, auth-bypass, and P2P relay abuse Targets Internet-exposed Dahua and OEM-rebranded cameras; compromises concentrated in Ukraine and Russia Scale 14,530+ devices in 35 days; 1,923 backdoored; 283 reached by serial alone Status

Hunt.io recovered a single operator's toolkit from an open directory: 14,530+ Dahua cameras compromised across Ukraine and Russia in 35 days. Inside the campaign

The access path nobody configured and nobody can see — what the Dahua P2P relay campaign says about inherited remote access.

Operation CameraSwarm compromised more than 14,530 Dahua devices in just 35 days using old authentication bypass vulnerabilities, weak credentials and P2P access.

La campaña, bautizada Operation CameraSwarm, implantó una cuenta trasera persistente que sobrevive incluso a un reseteo de fábrica en casi 2.000 cámaras Dahua. (Fuente: SecurityWeek) Un actor de amenazas llevó adelante una campaña masiva de hackeo contra cámaras IP de la marca Dahua, comprometiendo a más de 14.000 dispositivos en Ucrania y Rusia, según un reporte de Hunt.io. La actividad, identificada como Operation CameraSwarm, ocurrió entre el 17 de junio y el 22 de julio.

Groups Conversations All groups and messages Sign in     Operation CameraSwarm: Over 14,000 Dahua cameras compromised across Ukraine and Russia 0 views Eyal Estrin unread, 7:09 AM (22 minutes ago)    to https://hunt.io/blog/operation-cameraswarm-dahua-cameras-compromised Eyal Estrin Author | Cloud Architect | AWS • Azure • GCP Insights Social: @eyalestrin Connect: https://linktr.ee/eyalestrin Blog: https://security-24-7.com Reply all Reply to author Forward

In a large-scale campaign that researchers dubbed CameraSwarm, hackers compromised more than 14,500 Dahua IP cameras mostly in Ukraine and Russia.

In a large-scale campaign that researchers dubbed CameraSwarm, hackers compromised more than 14,500 Dahua IP cameras mostly in Ukraine and Russia.

Read more

Sicherheitsforscher des Unternehmens Hunt.io haben eine umfangreiche Cyberkampagne aufgedeckt, bei der tausende IP-Kameras des Herstellers Dahua infiltriert wurden. Unter dem Namen „Operation CameraSwarm“ identifizierten die Experten zwischen Mitte Juni und Ende Juli 2026 insgesamt 14.530 kompromittierte Geräte. Ein Großteil der betroffenen Hardware befindet sich laut den vorliegenden Berichten in der Ukraine und in Russland.Verschiedene Angriffsvektoren […] The post Operation CameraSwarm: 14.530 Dahua-Kameras infiltriert appeared first on BornCity.

Operation CameraSwarm targeted Dahua cameras across multiple countries, focusing on Russian and CIS telecom netblocks.

A threat actor carried out Operation CameraSwarm, compromising more than 14,000 Dahua IP cameras across Ukraine and Russia by combining brute-force attacks with authentication bypasses and a persistent RPC backdoor. Hunt.io found exposed attacker infrastructure and evidence that the toolkit was prepared for reuse or handoff, but the operator’s final motive...

Ce rapport d'analyse technique détaille l'opération CameraSwarm, une campagne de compromission massive de caméras IP Dahua menée entre le 17 juin et le 22 juillet 2026. Les CERTs nationaux concernés ont été notifiés le 10 août 2026 et le PSIRT de Dahua a été informé avant publication (TLP:AMBER).

In a large-scale campaign that researchers dubbed CameraSwarm, hackers compromised more than 14,500 Dahua IP cameras mostly in Ukraine and Russia. [...]

In a stunning display of cyber aggression, a lone operator successfully infiltrated over 14,500 Dahua security cameras within a mere five weeks. Alarmingly, the attacker meticulously planted a hidden backdoor account on nearly 2,000 of these compromised devices. Consequently, this insidious modification guarantees the intruder continued access, even if the legitimate owner dutifully changes the primary password. The extensive Operation CameraSwarm campaign…

A hacking campaign named Operation CameraSwarm has compromised over 14,500 Dahua surveillance devices using brute-force, known CVEs, and P2P service abuse.