Overview
- Hunt.io reconstructed Operation CameraSwarm from an exposed 407 MB operator directory and says the campaign compromised about 14,530 Dahua devices between June 17 and July 22, 2026.
- The attackers used three parallel paths: a brute‑force engine that reached roughly 12,324 unique IPs, exploits of two 2021 auth‑bypass flaws (CVE‑2021‑33044 and CVE‑2021‑33045) on about 1,923 cameras, and a serial‑number cloud‑relay route that reached around 283 devices.
- The toolkit installed a persistent backdoor account using the default p2pwn/p2password on many devices and included an offline recovery‑code generator that can redeem Dahua password‑recovery codes from serial numbers without the admin password.
- Key counts and the operator’s claim that 89.4% of probed serials returned an open channel come from the leaked operator material and have not been fully independently reproduced; CISA lists the two 2021 CVEs in its Known Exploited Vulnerabilities catalog and Dahua has issued firmware advisories.
- Device owners should check for the p2pwn account, disable P2P if not needed, rotate all camera credentials, and install vendor firmware updates because the cloud‑relay design and shared SDK credentials also put OEM‑rebranded lines at risk of privacy loss and surveillance abuse.