When most people think about a cyberattack, they picture servers going dark, databases emptied, or ransomware notes appearing on screens. What they rarely imagine is their office security camera quietly phoning home to an attacker’s Telegram account, snapping a photo of the room, and packaging the credentials for whoever wants to buy them next.
That is exactly what happened between June 17 and July 22, 2026, in a campaign researchers at Hunt.io have named Operation CameraSwarm.
The numbers alone make this one of the more significant IoT compromise operations documented this year. But what makes it genuinely unsettling is not the scale it is the design. The toolkit was not built to keep access. It was built to hand access over.
How It Started: A Hacker Who Exposed Themselves
The investigation began on July 23, 2026, when Hunt.io’s AttackCapture system crawled an open HTTP directory on the server at 154.86.119.60. The operator had left their entire working environment exposed to the public internet — 2,616 files, 234 subdirectories, 407 megabytes — because of a single command they had run as root:
cd /root && sudo python3 -m http.server 80 --bind 0.0.0.0In other words, they had accidentally turned their attack server into a public file share. Hunt.io walked in, copied everything, and built this report from what they found.
The shell history on the server showed three escalating masscan sweeps against port 37777 — Dahua’s Easy4IP management protocol — at 70,000, then 120,000, then 150,000 packets per second, confirming the operator was still tuning their scan rate when the filesystem was exposed.
The server itself predates the campaign by over a year. SSH fingerprint telemetry shows three operating system generations on this address, the earliest from April 2025. The infrastructure was repurposed, not provisioned fresh for this operation.
Three Ways In Running Simultaneously
What distinguishes CameraSwarm from a simple brute-force attack is its layered approach. The operator ran three distinct exploitation paths in parallel, each targeting a different weakness in Dahua’s ecosystem.
Path One: Brute Force at Scale
The first and most prolific method was credential guessing but not the crude, slow kind. The operator deployed a purpose-built asyncio framework capable of handling up to 4,000 concurrent connections, adaptive based on target list size.
Before opening a single connection, the tool raised Linux file-descriptor and connection-tracking limits directly. A Russian comment in the code reads: “without this, thousands of connections are silently dropped by the kernel.” This is engineering discipline, not script-kiddie assembly.
The engine hit 12,324 unique IP addresses. It also filtered by local time of day before scanning skipping any network block where the local clock fell outside 9 AM to 5 PM. Whether to avoid detection or simply to capture useful images during working hours, the code does not clarify. Both motivations are consistent with the behavior.
Every successful credential pair was posted immediately to a private Telegram channel, with a photo of what the camera could see.
Path Two: Authentication Bypasses That Need No Password
For cameras that survived the brute force – either because they had strong passwords or were simply not reached – the operator deployed p2pwn, a compiled Go binary chaining two known Dahua vulnerabilities.
CVE-2021-33044 exploits the fact that Dahua cameras unconditionally trust any client that identifies itself as a NetKeyboard hardware controller. When a device presents that identity, the password field is never evaluated. The exploit sends the literal string “Not Used” as the password and receives a full administrator session.
CVE-2021-33045 exploits the firmware reading the claimed source address from the request body rather than the actual TCP connection. By claiming to originate from 127.0.0.1, the attacker receives full administrative access without any credentials. Both bypasses execute in under a second against unpatched firmware.
Both of these vulnerabilities have been patched since October 2021. Cameras running firmware older than that patch window are exploitable instantly, with no credentials required.
Path Three: Serial Numbers Alone No Device Address Needed
The third path is the one that should concern any Dahua camera owner most, because it bypasses the network entirely.
Dahua’s cloud relay service – easy4ipcloud.com – allows any application to reach a camera behind a home router or firewall using only its serial number. The authentication to this relay uses credentials hardcoded identically into every Dahua client application ever shipped.
Presenting these hardcoded values authenticates the caller as a trusted Dahua application, regardless of who is actually calling. The only real barrier to reaching any camera through this path is knowing its serial number, precisely what the operator’s harvesting pipeline exists to produce at scale.
The operator collected serial numbers through Shodan queries, DDNS subdomain enumeration from dahuaddns.com, and a public camera fingerprinting tool. They then probed each serial against the relay before spending any effort on credentials.
The operator’s own log recorded that 89.4 percent of live serials returned an open, no-authentication channel. Phase one alone resolved the overwhelming majority of targets. Most exposed devices never demand a password at all.
Through this path alone, 283 cameras were reached by serial number alone, with no device address and in most cases no credentials.
The Backdoor That Survives a Factory Reset
After gaining access through either bypass, p2pwn does something particularly troubling. It installs a hidden account – username p2pwn, password p2password – over Dahua’s RPC interface.
This account is stored independently of the admin password. It survives a password change. On most firmware, it also survives a factory reset. Nearly 1,923 cameras carry this backdoor, installed across 19 days of operation.
Changing your password will not remove this. Resetting your camera to factory defaults will most likely not remove this either. The only reliable remediation is to audit the camera’s account list directly and manually delete the p2pwn account if it is present.
Built to Hand Off
Hunt.io’s researchers draw a careful but significant conclusion about what this toolkit was designed for. The transferable recovery-code design and the enterprise-format export pipeline suggest the toolkit was built to hand access to a third party. That is narrower than a confirmed commercial operation, which the evidence does not support but it is a meaningful distinction.
The offline recovery codes are the clearest evidence. A module in the toolkit derives administrative recovery codes for each compromised camera codes that grant cloud-level access to reset the device’s administrator password. These codes are derived entirely offline from the serial number, require no interaction with the device, and remain valid until Dahua changes the derivation server-side.
Runs write to dated per-prefix directories holding an append-only serial list, a JSON code map, and XML credential files batched sixty-four at a time. The output is clean, structured, and ready to hand to someone else.
A separate module batches credential hits into SMART PSS-compatible XML Dahua’s own enterprise camera-management platform. The 255-device split is SMART PSS’s own per-import ceiling, so the output is built to load directly into the vendor platform. Someone could import this XML file into Dahua’s legitimate management software and control 13,000 cameras through an ordinary-looking enterprise dashboard.
A Windows Malware Capability Staged but Separate
On the same server used for the camera operation, Hunt.io found a second, unrelated capability: a UPX-packed Windows binary that sandbox analysis classified as SalatStealer a commodity credential and cryptocurrency stealer sold as a service.
Alongside it was a PowerShell script designed to disable Microsoft Defender. The script uses five independent methods simultaneously: user-context PowerShell, a full-list override, CIM/WMI to bypass constrained language mode, a SYSTEM-context scheduled task, and a Group Policy registry key that survives reboots and Defender updates. Targeting C:\ wholesale, and reaching for Group Policy at all, indicates an intended enterprise victim rather than a home machine.
Hunt.io is careful to note this is a separate incident staged on the same host, not part of the camera campaign. Organizations tracking this operator should treat it as a distinct capability rather than folding it into the Dahua findings.
Geographic Targeting and Scale
The campaign’s targeting tells its own story. The largest single haul, on June 18, skewed toward Mexican and Vietnamese consumer ISP ranges. By late June the dominant geography was Russian and CIS telecom netblocks.
Thirteen p2pwn executions produced campaign folders named RU, RU2, RU3, RUNODIN, UA, UA1, UA2, UA4, UA5, dom, 123, and a final consolidated run. Targeting weighted toward Ukraine: the Ukrainian runs hold the largest share of results.
In total, the campaign reached cameras across at least 35 countries in 35 days. The device population extended beyond obvious security cameras — door-entry intercoms, a PC-based NVR software client fingerprinted identically to hardware, and OEM-rebranded product lines including RVi, ST-XVR, QVC, AC-D, and SNR, all speaking the same Dahua protocol.
This matters beyond Ukraine and Russia. Dahua is one of the world’s largest camera manufacturers. Its technology is embedded in OEM products sold under dozens of brand names in every region, including across the Middle East and Africa, where it powers surveillance systems in airports, banks, government offices, industrial facilities, and residential complexes.
What Security Teams Need to Do Now
The following ten steps are drawn directly from the technical findings and Hunt.io’s own mitigation guidance.
1. Audit camera account lists immediately. Any Dahua camera reachable on port 37777 between June and July 2026 should be treated as a potential compromise. Log in and check the user account list for an account named p2pwn. Remove it if present. This is the single most important action to take right now.
2. Assume all stored credentials were exfiltrated. Because the bypass chain performs a nine-call credential drain, assume every credential stored on a compromised camera was exfiltrated and rotate accordingly. This includes credentials the camera may have cached for communicating with an NVR.
3. Disable P2P connectivity unless actively in use. Cameras with P2P enabled can be reached by anyone who knows their serial number. Address-based blocking is not a reliable control because the relay routes across a pool of backend addresses. Disable P2P under Settings → Network unless actively required.
4. Apply Dahua Security Advisory SA-2021-0130 without delay. CVE-2021-33044 and CVE-2021-33045 have been patched since October 2021. If your firmware has not been updated since then, your cameras are exploitable with no password in under a second. Check your firmware version and update.
5. Treat offline recovery codes as a persistent threat. Codes generated in this campaign grant cloud-level administrative reset by serial number and remain usable until Dahua alters the derivation server-side. Removing the backdoor account does not invalidate them. Contact Dahua support if you believe your serial numbers were harvested.
6. Block port 37777 at the perimeter. This port should never be reachable from outside your network. If remote access to cameras is required, route it through a VPN. No Dahua management interface should be directly internet-facing.
7. Monitor for suspicious login patterns. Login requests carrying “clientType”: “NetKeyboard” or “loginType”: “Loopback” with “ipAddr”: “127.0.0.1” do not occur in legitimate Dahua client traffic. Any such request in your logs should be treated as a compromise indicator.
8. On Windows estates, monitor for Defender exclusion tampering. The staged Windows malware uses Group Policy to disable Defender coverage across the entire C:\ drive. Look for CIM method invocations against MSFT_MpPreference and unscheduled policy refreshes.
9. Extend your asset inventory to OEM-branded cameras. Amcrest, Lorex, Annke, and Swann cameras run on Dahua’s cloud backend. If you have any of these on your network, apply the same checks. The exploitation toolkit targets the underlying platform regardless of the brand on the case.
10. Invest in security awareness training for your physical security and facilities teams. Camera systems are increasingly managed by non-IT staff who may not recognize a firmware update as a security obligation. Saintynet’s cybersecurity training programs can bridge that gap with practical, sector-specific guidance for operations and infrastructure teams.
The Wider Picture
Hunt.io is careful about attribution. The toolkit is assembled from at least six upstream developers’ work, written progressively in Spanish and then Russian, reusing research from public repositories and Discord communities. This operator is not the only party running these exploits or SalatStealer. The same NetKeyboard bypass is tied to a separate Iran-aligned cluster, a Telnet-based Dahua DVR campaign with no CVE at all, and SalatStealer resold across at least five unconnected operations. Dahua exploitation is common ground, not one actor’s signature.
The relevant national CERTs were notified on August 10, 2026, and Dahua’s PSIRT engaged with the researchers ahead of publication. This report was held under TLP:AMBER until August 18, 2026.
Conclusion
Operation CameraSwarm is not a sophisticated nation-state operation. It is something in some ways more concerning: a single operator with a borrowed, progressively refined toolkit who compromised more than 14,000 cameras in 35 days, installed backdoors that survive factory resets on nearly 2,000 of them, generated transferable administrative recovery codes for hundreds more, and built the entire output into a format designed for handoff to someone else.
The cameras are still out there. The backdoors are still installed on nearly 2,000 of them. The recovery codes are still valid. And the vulnerabilities being exploited – CVE-2021-33044 and CVE-2021-33045 – have had patches available since 2021.
For organizations across the MEA region and globally, where Dahua and its OEM derivatives are embedded in critical infrastructure, this is not a theoretical risk. Check your cameras. Update your firmware. Disable P2P. Remove the p2pwn account. And do it before someone who received that handoff file acts on it.
