As reported by The Hacker News, researchers at Hunt.io have disclosed Operation CameraSwarm—a campaign that compromised over 14,530 Dahua devices between June 17 and July 22, 2026. The operation was reconstructed from an exposed 407 MB working directory and attributed to three attack paths: brute-force credential attacks (12,324 IPs), authentication bypasses via two 2021 CVEs (1,923 cameras), and a P2P relay technique reaching devices behind NAT (283 cameras). Compromises were concentrated in Ukraine and Russia.

Security Impact: As reported by The Hacker News, researchers at Hunt.io have disclosed Operation CameraSwarm—a campaign that compromised over 14,530 Dahua devices between June 17 and July 22, 2026.

The most striking detail is not the scale—it is the age of the vulnerabilities. CVE-2021-33044 and CVE-2021-33045 were disclosed five years ago, patched by Dahua, and added to CISA's Known Exploited Vulnerabilities catalog. Yet they remain productive attack vectors in 2026. This is not a zero-day story; it is a firmware hygiene and asset lifecycle failure story.

Vulnerability Details

CVECVSS (NVD)CVSS (Dahua)MechanismPatch StatusKEV Listed
CVE-2021-330449.8 (Critical)8.1 (High)Auth bypass via NetKeyboard client type during authenticationFirmware fix availableYes
CVE-2021-330459.8 (Critical)8.1 (High)Auth bypass via loopback login request using 127.0.0.1Firmware fix availableYes
Both vulnerabilities allow attackers to bypass device identity authentication by constructing malicious data packets. The CVSS discrepancy between Dahua's advisory (8.1) and NVD (9.8) is notable—defenders should treat these as Critical given the NVD assessment and confirmed mass exploitation.

Why This Matters Beyond the Headline

Three structural problems converge in this campaign:

Vulnerability Details
IoT firmware rot is systemic. Surveillance cameras are deployed and forgotten. Organizations rarely inventory them, much less track firmware versions. A five-year-old patched vulnerability should not produce 1,923 compromises in a single month.
P2P relay functionality creates an unauthenticated attack surface. As ITRES Labs noted, the P2P relay establishes a route without prior authentication—meaning devices reachable through cloud relay services are exposed even when not directly internet-facing. Disabling P2P where unnecessary is not optional hardening; it is essential attack surface reduction.
Exposed attacker infrastructure is a gift—when monitored. Hunt.io reconstructed this entire campaign from a misconfigured working directory. Defenders should be actively scanning threat intelligence feeds and exposed-data repositories for indicators matching their own infrastructure.
The fact that a public p2pwn repository accepts Dahua serial numbers as input, checks for both CVEs, and ships with a default dummy-account configuration means this capability is commoditized. The barrier to entry for compromising Dahua deployments is effectively zero.

Who Is at Risk

Any organization running Dahua cameras or DVRs with unpatched firmware is exposed. Highest-risk deployments include: physical security and surveillance installations at government, critical infrastructure, and enterprise facilities; devices exposed via P2P cloud relay (common in remote site monitoring); and any deployment using default or weak credentials. The geographic concentration in Ukraine and Russia suggests potential reconnaissance value for conflict-zone intelligence, but the tooling is not regionally restricted.

Shield53 Recommendations

Immediate Actions

  • Patch all Dahua devices to the latest firmware from the official Dahua download portal. Do not rely on intermediary distributors for firmware.
  • Disable P2P / cloud relay services on every device where remote cloud access is not explicitly required. If remote access is needed, use a VPN or zero-trust network access layer instead.
  • Audit for persistent accounts. The campaign created 1,923 persistent accounts. Check for unauthorized users on every Dahua device and remove any that cannot be attributed to legitimate administration.
  • Force credential rotation across all Dahua management interfaces. Eliminate default credentials and enforce strong, unique passwords per device.
  • Network segmentation. Move surveillance device management traffic onto an isolated VLAN with strict egress filtering. Cameras should not have unrestricted internet access.

Strategic Actions

  • Build an IoT asset inventory that tracks manufacturer, model, firmware version, and exposure status for every connected device. This is table stakes for any organization with more than a handful of cameras.
  • Subscribe to CISA KEV updates and cross-reference against your asset inventory monthly. If a KEV-listed vulnerability affects a device you own, it should trigger an expedited patch workflow—not a quarterly review.
  • Monitor for P2P relay traffic from surveillance networks. Unexpected outbound connections to Dahua cloud relay infrastructure may indicate active compromise or misconfiguration.