As reported by SecurityAffairs, Hunt.io's reconstruction of Operation CameraSwarm exposes a deeply uncomfortable reality for IoT defenders: the most damaging attack path in this campaign didn't require a password at all. It required a serial number and Dahua's own cloud relay infrastructure.
The campaign, active from June 17 through July 22, 2026, compromised over 14,000 Dahua cameras primarily across Ukraine and Russia. What makes this operation particularly instructive is that it wasn't enabled by a novel zero-day or sophisticated supply chain compromise—it was enabled by a combination of unpatched 2021 vulnerabilities and a fundamental design flaw in how Dahua's cloud relay authenticates sessions.
The Cloud Relay Problem Is Structural, Not Configurational
The most significant finding is the third attack vector: serial-number-based access through Dahua's cloud relay. The relay allows applications to reach cameras behind NAT using only a serial number. Authentication to that relay relies on fixed SDK credentials embedded identically in every Dahua client application ever shipped. The operator's own telemetry showed 89.4% of live serials returned an open, no-authentication channel.
This is not a misconfiguration that customers can fix. It is an architecture decision by the vendor that effectively makes every camera's serial number a public identifier that doubles as an access credential.
Defenders who have spent years enforcing strong admin passwords, disabling default accounts, and segmenting camera networks have been addressing the wrong threat surface for this particular attack path. The device never authenticates the connecting party—it authenticates the session via a token the cloud issued, and obtaining that token requires only the shared SDK credentials.
Backdoor Persistence Compounds the Problem
The authentication-bypass chain leveraged two 2021 Dahua vulnerabilities to plant persistent backdoor accounts on 1,923 cameras. These accounts are stored independently of the admin password and survive both password changes and, on most firmware, factory resets. This means even organizations that diligently rotated credentials after learning of the 2021 flaws may still harbor active backdoor accounts if they were compromised before patching.
| Attack Path | Scale | Authentication Required | Persistence |
|---|---|---|---|
| Brute-force engine | 12,300+ addresses targeted | Weak/default credentials | Variable |
| 2021 auth-bypass chain | 1,923 cameras backdoored | None (vulnerability exploit) | Survives password change and most factory resets |
| Cloud relay by serial number | 283 cameras confirmed; 89.4% of probed serials accessible | None (shared SDK credentials) | Session-based, repeatable |
Who Is at Risk
Any organization running Dahua cameras—particularly those deployed in sensitive environments like critical infrastructure, government facilities, or corporate premises—should assume potential compromise. The geographic concentration in Ukraine and Russia suggests potential intelligence-gathering motivation, but the tools and techniques are trivially replicable by any actor. The exposed operator directory also contained a Windows stealer staged on the same server, indicating the operation may have had secondary objectives beyond camera access.
Industries most exposed include manufacturing, logistics, and any sector using Dahua cameras for physical security monitoring. Small and midsize deployments are particularly vulnerable because they rarely receive dedicated security attention.
Shield53 Recommendations
Immediate Actions
Strategic Actions
- Reassess IoT procurement criteria: Include cloud relay architecture and credential model as mandatory vendor evaluation criteria. Shared embedded credentials across an entire product line should be treated as a critical design deficiency.
- Implement serial number hygiene: Treat camera serial numbers as sensitive identifiers. Do not publish them in asset inventories accessible to broad internal audiences, and never expose them in public-facing documentation.
- Plan for vendor risk: This incident demonstrates that IoT compromise can occur without any customer-side misconfiguration. Include vendor architecture risk in your threat modeling and maintain contingency plans for rapid camera network isolation.
The broader implication is sobering. The IoT security community has long focused on default passwords and firmware patching as the primary defensive levers. Operation CameraSwarm demonstrates that when a vendor's cloud architecture fundamentally lacks per-device authentication, those controls are necessary but insufficient. Until Dahua and similar vendors redesign their relay authentication to use per-device cryptographic identities rather than shared SDK credentials, every device with a discoverable serial number remains one API call away from unauthorized access.
