Hackers Compromise Over 14,500 Dahua Devices in Large-Scale CameraSwarm Campaign
Security researchers have uncovered a large-scale campaign dubbed Operation CameraSwarm that compromised more than 14,500 Dahua surveillance devices using credential attacks, authentication-bypass vulnerabilities, and peer-to-peer connectivity. The campaign highlights the continuing security risks associated with outdated IoT firmware, exposed camera infrastructure, weak credentials, and unnecessary P2P services.
Cybersecurity researchers have uncovered a large-scale campaign targeting Dahua surveillance cameras and related devices, with more than 14,530 devices reportedly compromised between June 17 and July 22, 2026.
The operation, tracked as Operation CameraSwarm, combined several attack techniques rather than relying on a single vulnerability. Attackers used credential-based attacks, previously disclosed authentication-bypass flaws, and Dahua's peer-to-peer connectivity mechanisms to reach vulnerable devices — including systems located behind Network Address Translation (NAT).
Researchers reconstructed the campaign after discovering an exposed working directory containing hundreds of megabytes of operational data, including attack tools, shell history, logs, scripts, and campaign records.
Three Main Attack Methods
According to the investigation, the attackers relied on three primary access methods.
1. Credential attacks
The largest portion of compromised systems was associated with credential-based attacks. Researchers identified 12,324 unique IP addresses across more than 13,000 campaign records.
This demonstrates that weak, reused, or exposed credentials remain one of the most effective methods for compromising internet-connected surveillance equipment.
2. Authentication bypass vulnerabilities
Attackers also exploited two previously disclosed Dahua vulnerabilities:
- CVE-2021-33044
- CVE-2021-33045
Both vulnerabilities allow attackers to potentially bypass device authentication by sending specially crafted requests.
The flaws affect certain Dahua cameras and related products and remain particularly dangerous when devices continue operating with outdated firmware.
Researchers linked approximately 1,923 cameras to this attack path, with persistent accounts reportedly configured on compromised systems.
Old Vulnerabilities Remain a Serious Threat
Although CVE-2021-33044 and CVE-2021-33045 were disclosed several years ago, they continue to represent a security risk because vulnerable devices remain deployed in production environments.
The vulnerabilities have also been included in the U.S. Cybersecurity and
Infrastructure Security Agency's Known Exploited Vulnerabilities (KEV) Catalogue, emphasising that they have been actively exploited rather than representing only theoretical security issues.
Organisations using affected Dahua equipment should ensure that supported devices are running vendor-provided patched firmware.
3. P2P Relay Access
Researchers also identified 283 cameras accessed through a peer-to-peer relay mechanism.
Dahua's P2P infrastructure is designed to make remote camera access easier, especially when devices are located behind NAT or firewalls. However, this functionality can increase the attack surface when improperly configured or combined with vulnerable firmware and weak authentication.
The investigated attack infrastructure reportedly used device serial numbers to locate and establish communication channels with Dahua equipment through the vendor's P2P ecosystem.
A successful P2P connection can make an otherwise externally inaccessible device reachable through relay infrastructure, although device-level authentication may still be required depending on the firmware and configuration.
Geographic Concentration
According to the campaign analysis, confirmed compromises were heavily concentrated in Ukraine and Russia.
Researchers also observed Russian-language artefacts in the exposed attacker infrastructure, suggesting that the operator was likely Russian-speaking.
However, the available evidence does not establish attribution to a specific government, criminal organisation, or known threat actor.
Researchers assessed that portions of the attack infrastructure may have been designed to provide or transfer compromised camera access to third parties.
Why Compromised Cameras Matter
Internet-connected surveillance devices should not be treated as simple cameras.
A compromised IP camera or network video recorder can become an entry point into a wider network and may potentially provide attackers with:
- Unauthorised access to surveillance feeds
- Information about physical environments
- Persistent network access
- Infrastructure for botnets or proxy networks
- A foothold for lateral movement
- Access to additional devices on poorly segmented networks
Surveillance systems therefore require the same security controls applied to other network infrastructure.
Recommended Security Measures
Organisations operating Dahua cameras or NVR systems should review their environments and consider the following actions:
- Upgrade devices to the latest supported firmware from the official vendor source.
- Disable P2P functionality when remote relay access is not required.
- Replace default, weak, or reused passwords with strong unique credentials.
- Review configured users and remove unknown or unnecessary accounts.
- Restrict camera management interfaces from direct internet exposure.
- Place CCTV and IoT infrastructure on dedicated network segments or VLANs.
- Restrict communication between surveillance networks and critical business systems.
- Monitor camera infrastructure for unusual outbound connections or authentication activity.
- Replace unsupported devices that can no longer receive security updates.
The incident demonstrates that vulnerabilities do not become harmless simply because they are several years old. When internet-facing IoT devices remain unpatched, previously documented vulnerabilities can continue to provide attackers with reliable access at significant scale.
Analysis and context
Operation CameraSwarm demonstrates a recurring problem in IoT security: the gap between vulnerability disclosure and real-world remediation.
The most concerning aspect of this campaign is not necessarily the discovery of a new zero-day vulnerability. Instead, attackers were able to combine existing weaknesses — old authentication flaws, exposed credentials, and remote connectivity features — to compromise thousands of devices.
From a defensive perspective, this illustrates why vulnerability management cannot focus exclusively on newly disclosed CVEs.
An authentication vulnerability discovered in 2021 can remain highly relevant in 2026 when thousands of devices continue running vulnerable firmware.
The campaign also highlights the security implications of P2P functionality. Features designed to simplify remote access can unintentionally expand an organization's attack surface because they may allow devices located behind NAT to communicate through external relay infrastructure.
For enterprise environments, surveillance equipment should therefore be treated as part of the organization's security architecture rather than as isolated physical-security hardware.
Network segmentation is particularly important. CCTV cameras, NVR systems, access-control devices, and other IoT equipment should ideally operate within dedicated VLANs with strictly controlled access to internal services.
Organizations should also maintain an accurate inventory of IoT devices, track firmware versions, monitor vendor security advisories, and remove systems that have reached end-of-support.
CameraSwarm ultimately reinforces a simple security principle: an internet-connected device that is not continuously maintained eventually becomes part of the attack surface.
Source: The Hacker News, Hunt.io, Dahua Security advisories, CISA Known Exploited Vulnerabilities Catalog and related security research.