Listen to this Post
Introduction: When Security Cameras Become the Attack Surface
Internet-connected security cameras are supposed to watch the world for us. In the CameraSwarm campaign, however, attackers turned thousands of those same cameras into silent victims—and potentially into surveillance tools under someone else’s control.
Researchers at Hunt.io uncovered a large-scale operation targeting Dahua IP cameras, with more than 14,500 devices compromised during a campaign that lasted at least 35 days between June 17 and July 22, 2026. The majority of confirmed victims were concentrated in Ukraine and Russia, although the campaign’s infrastructure and scanning activity were considerably broader.
What makes CameraSwarm especially disturbing is not simply the number of cameras involved. The operation combined several attack paths at once: credential brute-forcing, exploitation of long-known Dahua authentication vulnerabilities, persistent backdoor installation, and abuse of cloud-connected recovery mechanisms.
Even more remarkably, investigators did not discover the campaign because of a sophisticated takedown or a dramatic malware sample. They found it because the operator apparently left a working directory exposed on an HTTP server.
That mistake gave researchers an unusually detailed look inside the operation.
The Accidental Treasure Trove
Hunt.io researchers discovered an openly accessible directory containing approximately 407 MB of operational data. It included 2,616 files spread across 234 directories, providing a rare window into how the campaign operated.
The recovered material reportedly contained source code, logs, credentials, shell history, captured camera images, target information and exploitation results.
For defenders, this kind of exposure is extraordinarily valuable. Instead of observing an attack from the outside, researchers could reconstruct portions of the attacker’s workflow from the inside.
It revealed that CameraSwarm was not a single exploit fired repeatedly against random devices. It was a multi-stage operation built around several complementary methods.
14,530 Cameras Compromised in 35 Days
According to
The scale is significant because the campaign was able to combine automation with multiple access techniques.
One system focused on exposed Dahua services and weak credentials.
Another used known authentication vulnerabilities.
A third path abused
The attackers therefore had multiple ways to reach a camera even when one method failed.
That redundancy is one of the most important lessons from CameraSwarm.
Attack Path One: Brute-Forcing Exposed Dahua Services
The first major component scanned for Dahua devices exposing TCP port 37777, a service associated with Dahua’s SDK communications.
The attackers attempted credentials against discovered devices and, when successful, were able to access camera functionality and obtain snapshots.
Hunt.io found evidence that successful results were sent to Telegram and exported into formats compatible with Dahua management software.
This transforms a conventional credential attack into something much more operationally useful.
The attackers were not merely collecting a list of vulnerable cameras. They were identifying cameras they could actually access and obtaining visual information from them.
Attack Path Two: The Persistent “p2pwn” Account
The most alarming part of the campaign involved exploitation of CVE-2021-33044 and CVE-2021-33045.
Dahua itself documented these vulnerabilities as authentication-bypass issues that could allow attackers to bypass device identity authentication through specially constructed network packets. Dahua assigned the vulnerabilities a CVSS base score of 8.1.
CameraSwarm allegedly used those weaknesses through a tool identified as p2pwn.
The tool could install a dedicated account named:
p2pwn
with the associated password:
p2password
That detail makes the incident particularly important for defenders because changing the legitimate administrator password does not necessarily eliminate a separately created backdoor account.
According to
Even more concerning, the account reportedly survives password changes and, on most affected firmware versions, can survive a factory reset.
Why a Factory Reset May Not Be Enough
For years, “reset the device and change the password” has been treated as a basic recovery strategy for compromised consumer and enterprise equipment.
CameraSwarm demonstrates why that assumption can be dangerous.
If malicious persistence is stored or recreated through mechanisms that are not eliminated by a normal reset, an administrator could believe a camera has been cleaned when the attacker still has a route back in.
This is why incident response for compromised IoT equipment must go beyond changing credentials.
Administrators should verify firmware versions, inspect accounts, review network behavior, examine logs where available, and confirm that known vulnerabilities have been remediated.
Attack Path Three: The Cloud Relay Problem
The third attack path was arguably the most unusual.
Hunt.io found evidence that attackers could reach cameras located behind NAT through a Dahua cloud/P2P relay mechanism.
In some cases, the attacker apparently needed only the camera’s serial number together with credentials embedded in Dahua applications.
The researchers reported that 283 cameras were reached through this technique.
The most troubling statistic was that 89.4% of live serial numbers tested through the relevant mechanism exposed an access channel without authentication, according to the recovered campaign data.
That finding illustrates a broader cybersecurity problem: cloud connectivity can fundamentally change the security model of an IoT device.
A camera does not have to expose a traditional public-facing web interface to become remotely reachable.
The Serial Number Was More Powerful Than It Should Have Been
CameraSwarm also abused an offline recovery-code generation mechanism.
The toolkit reportedly derived recovery information from the camera’s serial number and used Dahua’s standard password-recovery process to obtain new codes without knowing the current administrator password.
That creates a dangerous relationship between a supposedly identifying piece of information and an authentication mechanism.
A serial number is not necessarily secret.
It can appear on product labels, documentation, photographs, inventory records, screenshots or other places.
If possession of such an identifier can contribute to account recovery, the identifier effectively becomes part of the security boundary.
Misleading CVE References Added Another Layer of Confusion
Researchers also discovered references to CVE-2024-39943 and CVE-2025-31702 inside the recovered toolkit.
However,
This distinction matters.
Threat actors frequently reuse public security tools, exploit code and vulnerability references. A tool containing a CVE number does not automatically prove that the corresponding vulnerability was exploited during a particular campaign.
That is why incident investigators need to distinguish between capabilities present in a toolkit and techniques actually demonstrated against victims.
The Campaign Was Bigger Than Ukraine and Russia
Although the confirmed victim population was heavily concentrated in Ukraine and Russia, the scanning activity itself was broader.
Hunt.io reported that the operator initially examined Russian address space before expanding scanning across the global IPv4 range.
Eventually, activity appeared to settle heavily around Russian and broader CIS telecommunications networks.
This is an important distinction.
The geographic concentration of victims does not necessarily mean the campaign was designed exclusively for those countries.
Automated scanners often sweep huge portions of the internet and only later concentrate on networks where the attacker finds a high rate of useful targets.
Russian Comments Do Not Prove Attribution
The researchers also found Russian-language comments inside modified code.
That may provide a clue about the environment in which some components were developed or modified, but it should not automatically be treated as proof of the operator’s nationality or affiliation.
Cybersecurity attribution is notoriously difficult.
Code comments can be copied.
Tools can be purchased.
Public repositories can be modified.
Infrastructure can be rented.
Attackers can deliberately plant misleading clues.
CameraSwarm demonstrates why technical evidence should be separated from speculation about who is ultimately responsible.
The
The most ironic part of the entire campaign is how researchers gained access to so much information.
The attackers themselves apparently left a working directory exposed through an HTTP server.
That directory became an intelligence gold mine.
The same operational security failures that defenders constantly warn organizations about—unprotected directories, exposed development files, leaked credentials and careless infrastructure management—can hurt attackers too.
In this case, a single configuration mistake gave researchers access to an extraordinary amount of evidence.
Why Camera Compromise Is More Serious Than It Sounds
A compromised IP camera is not simply another compromised IoT device.
Cameras can contain microphones, live video feeds, stored footage, network credentials and information about the physical environment around them.
A successful attacker may learn when employees arrive at a building.
They may observe entrances and exits.
They may identify sensitive rooms.
They may monitor industrial environments.
They may capture people who assume the camera is protecting them.
And if the device sits inside a trusted network, it can potentially become an initial foothold for additional attacks.
This is why IoT security should be treated as part of enterprise security—not as an isolated hardware problem.
Deep Analysis: What Defenders Should Look For
Check Whether TCP 37777 Is Exposed
Administrators should first determine whether Dahua devices are unnecessarily reachable from untrusted networks.
A safe internal inventory check can begin with:
nmap -sT -p 37777 --open 192.168.1.0/24
Only scan networks and devices you own or are explicitly authorized to assess.
If cameras are appearing on the public internet when they do not need to be, firewall rules should be reviewed immediately.
Search for the Known Backdoor Account
On affected devices, administrators should inspect the configured user list through the official administrative interface.
The account name of particular interest is:
p2pwn
If it exists unexpectedly, treat the device as potentially compromised rather than simply deleting the account and moving on.
Review Firmware Versions
Dahua’s official advisory identifies CVE-2021-33044 and CVE-2021-33045 as authentication-bypass vulnerabilities affecting certain product families and provides fixed firmware information.
The correct remediation is to move affected devices to an appropriate patched firmware release or later supported version.
Administrators should avoid downloading firmware from unofficial repositories.
Look for Suspicious Authentication Activity
Where device logs are available, defenders should investigate unexpected authentication attempts, unusual account creation, unfamiliar source addresses and repeated access around the campaign period.
A basic Linux log search might look like:
grep -Ei 'login|auth|user|account|37777' /path/to/security.log
The exact log location and available fields vary by device and firmware.
Review Network Connections
Network monitoring can also help identify cameras communicating with unexpected external destinations.
For a Linux-based network sensor, defenders could review connections associated with known camera addresses:
ss -tunap
For broader enterprise environments, firewall, IDS, DNS and NetFlow records are generally more useful than relying solely on the camera’s own logs.
Do Not Assume Password Changes Clean the Device
This is perhaps the most important operational lesson.
If a device was exposed during the campaign window and evidence suggests compromise, changing the administrator password should be considered only one remediation step.
The response should include:
1. Isolate the device if practical.
2. Preserve relevant logs and forensic evidence.
3. Inspect user accounts.
4. Verify firmware.
5. Apply the appropriate security update.
6. Disable unnecessary P2P functionality.
7. Rotate credentials associated with the device.
8. Review network traffic.
9. Check connected systems for follow-on activity.
- Reassess the device before returning it to normal service.
Disable P2P When It Is Not Required
Dahua documentation describes P2P as a mechanism for remote access to compatible devices.
If an organization does not need remote P2P access, disabling it reduces the externally reachable attack surface.
Security is often strongest when unnecessary functionality is removed rather than merely monitored.
A Dangerous Lesson About “Smart” Devices
CameraSwarm is part of a much larger pattern visible across modern cybersecurity.
IoT devices are increasingly cloud-connected.
They automatically update.
They communicate with vendor infrastructure.
They expose APIs.
They support mobile applications.
They often contain powerful hardware but comparatively limited security controls.
Convenience has become deeply intertwined with connectivity.
And every new connectivity feature can create another possible attack path.
The Supply Chain Is Part of the Attack Surface
The recovered toolkit also appears to have incorporated components from public or repurposed security tools.
That should concern defenders because attackers do not necessarily need to develop sophisticated capabilities themselves.
They can combine existing scanners, exploit implementations, credential lists and cloud mechanisms into a single operational framework.
The public availability of offensive security tooling means the barrier to launching large-scale IoT attacks continues to fall.
The same tools can support legitimate security research, penetration testing and vulnerability discovery—but they can also be assembled into automated criminal infrastructure.
The Camera Is Only the Beginning
One of the most important questions after CameraSwarm is not “How many cameras were compromised?”
It is:
What could an attacker do after compromising one?
A camera may sit on the same network as computers, servers, access-control systems, printers, storage systems and administrative interfaces.
Even if the camera itself contains nothing valuable, its network position can be valuable.
That is why modern security architecture increasingly emphasizes segmentation.
IoT devices should not automatically have unrestricted access to corporate systems.
What Undercode Say:
- The Number Is Important, But the Architecture Is More Important
CameraSwarm is alarming because of its scale, but the underlying architecture is what deserves the most attention.
- Attackers Did Not Depend on One Vulnerability
They combined brute force, known vulnerabilities and cloud-based access mechanisms.
3. Redundancy Made the Campaign More Resilient
When one attack path failed, another could potentially succeed.
4. Old Vulnerabilities Never Truly Disappear
CVE-2021-33044 and CVE-2021-33045 were disclosed years before this campaign.
5. Unpatched IoT Devices Become Long-Term Targets
A vulnerability can remain useful long after its disclosure.
6. Internet Exposure Multiplies Risk
An ordinary camera becomes significantly more dangerous when directly exposed to hostile networks.
- Credentials Are Not the Whole Security Model
CameraSwarm demonstrates why authentication and device integrity must be considered separately.
8. A Backdoor Account Changes the Incident
Once persistence exists independently of the main administrator password, routine password rotation may not be enough.
- Factory Reset Is Not a Universal Cure
Organizations need to understand exactly what a reset removes on their hardware and firmware.
- Cloud Infrastructure Can Become an Attack Surface
P2P and relay systems can create remote access paths that administrators may not see in traditional firewall reviews.
- Serial Numbers Should Not Become Authentication Secrets
Identifiers are often discoverable.
- Recovery Systems Deserve the Same Security as Login Systems
A strong password is meaningless if the recovery process provides an easier path around it.
13. IoT Security Is Enterprise Security
A camera connected to a corporate network is part of the organization’s attack surface.
14. Visibility Matters
The attackers were eventually exposed partly because their infrastructure was poorly protected.
15. Operational Security Can Defeat Sophisticated Attackers
A technically capable operation can still collapse because of a basic infrastructure mistake.
16. Automation Changes the Economics of Attacks
Thousands of devices can be tested without manually touching every target.
- Brute Force Remains Effective Against Weak IoT Security
Modern defenses do not eliminate the risk created by predictable or reused credentials.
18. Public-Facing IoT Should Be Minimized
If direct internet exposure is unnecessary, it should generally be removed.
19. Segmentation Is Critical
A compromised camera should not provide a convenient bridge into sensitive corporate networks.
20. Logging Should Include IoT
Organizations frequently monitor servers while barely monitoring cameras and network appliances.
21. Security Teams Need Device Inventories
You cannot patch hardware you do not know exists.
22. Asset Discovery Is a Security Control
Knowing which cameras expose TCP 37777 can be more valuable than waiting for an alert.
23. Firmware Management Needs Governance
IoT equipment should have defined patching procedures just like servers and workstations.
- “It Is Only a Camera” Is a Dangerous Assumption
A modern camera is a networked computer with sensors.
25. Visual Data Can Be Extremely Sensitive
Live video can reveal people, processes, schedules, facilities and physical security weaknesses.
- Attackers Can Monetize Access in Multiple Ways
Surveillance, extortion, intelligence gathering and lateral movement are all possible motivations.
27. Attribution Should Remain Evidence-Based
Russian comments alone do not establish who operated CameraSwarm.
- Threat Intelligence Becomes Stronger With Operational Evidence
The exposed directory allowed researchers to correlate tools, logs and results.
- Defensive Research Benefits From Studying Attacker Workflows
Knowing how an operation actually works helps defenders identify earlier warning signs.
30. Vulnerability Databases Are Not Enough
Organizations must understand how vulnerabilities are chained in real attacks.
- Authentication Bypass Can Be More Dangerous Than Password Theft
If authentication itself can be bypassed, changing credentials may not address the root problem.
32. Recovery Mechanisms Must Be Threat-Modeled
Password recovery should never become the weakest link in an otherwise protected device.
33. Vendors Need Secure-by-Default Designs
Customers should not have to understand complex cloud relay architecture simply to operate a camera safely.
34. Legacy Firmware Creates Long-Term Exposure
Older equipment often remains deployed for years after vulnerabilities become public.
- Network Controls Provide an Additional Safety Layer
Even when patching is delayed, segmentation and access restrictions can reduce exposure.
36. IoT Incident Response Needs Specialized Procedures
Traditional endpoint cleanup does not always translate directly to embedded devices.
37. Administrators Should Treat Unexpected Accounts Seriously
An unfamiliar privileged account is a potential indicator of compromise.
38. CameraSwarm Shows Why Threat Hunting Matters
The campaign was not simply theoretical; researchers reconstructed real operational activity from attacker infrastructure.
- The Most Valuable Defense May Be Reducing Attack Surface
Disabling unused P2P services and blocking unnecessary internet exposure can eliminate entire classes of attacks.
40. The Bigger Warning Is Still Ahead
CameraSwarm may not represent an isolated incident. It could be a preview of a future where automated systems continuously search millions of connected cameras, routers, DVRs and other devices for weak entry points.
✅ More Than 14,500 Cameras Were Reportedly Compromised
Hunt.io’s reported figure is 14,530 compromised Dahua cameras during the observed campaign period. Independent discussion of the Hunt.io findings also reflects the same figure.
✅ CVE-2021-33044 and CVE-2021-33045 Are Real Dahua Vulnerabilities
Dahua’s own PSIRT advisory confirms both CVEs and describes them as authentication-bypass vulnerabilities affecting certain Dahua products.
✅ The p2pwn Account Is Technically Plausible and Documented in Related Tooling
The publicly available p2pwn project includes configuration for a dummy p2pwn account and supports Dahua SDK/CGI functionality, although the existence of the public tool alone does not independently prove every detail of the CameraSwarm campaign.
⚠️ The Geographic Concentration Does Not Prove Attribution
The
⚠️ CVE References Inside a Toolkit Do Not Automatically Mean Those CVEs Were Exploited
Hunt.io’s analysis specifically distinguishes the misleading CVE references from the techniques actually observed in the campaign. This is an important distinction when evaluating threat reports.
Prediction
(+1) IoT Security Will Become a Much Bigger Enterprise Priority
The most likely positive development is that incidents like CameraSwarm will push organizations to treat cameras, DVRs, NVRs and other connected devices as first-class security assets.
Organizations that combine firmware management, network segmentation, credential rotation, exposure monitoring and centralized logging will be significantly better positioned against future automated IoT campaigns.
The technology itself is not the enemy.
The danger comes from deploying internet-connected hardware without treating it as part of the security architecture.
(+1) Automated IoT Discovery Will Improve Defensive Visibility
As attackers increasingly automate scanning, defenders will have to automate asset discovery as well.
Organizations will increasingly monitor exposed ports, unexpected cloud connections, firmware versions and abnormal authentication patterns across entire IoT fleets.
(-1) More Cameras Will Become Targets of Automated Campaigns
The economics strongly favor automation.
An attacker does not need to manually compromise 14,000 cameras.
A scanner can continuously search enormous address ranges, test known weaknesses and keep successful targets in a database.
That means the next CameraSwarm-style campaign could potentially be larger, faster and more geographically distributed.
(-1) Legacy IoT Devices Will Remain the Weakest Link
The greatest challenge may not be new vulnerabilities.
It may be old devices that were installed years ago, forgotten, exposed to the internet and never updated.
As long as those systems remain connected, attackers have an incentive to keep searching for them.
The Bigger Picture: Cameras Are Becoming Cybersecurity Assets
CameraSwarm is ultimately more than a story about Dahua cameras.
It is a warning about the rapidly expanding universe of connected devices.
Every camera, smart door controller, industrial sensor, router, recorder and network appliance creates another potential entry point.
The more devices an organization connects to the internet, the more important asset visibility, segmentation, patching and continuous monitoring become.
The attackers behind CameraSwarm reportedly spent weeks systematically searching for vulnerable devices.
Defenders need to think with the same level of persistence.
The most important question is no longer whether a camera is connected to the internet.
It is whether the organization knows exactly what that connection allows.
And after more than 14,500 cameras were compromised in just 35 days, assuming that an IoT device is harmless simply because it is “only a camera” is no longer a defensible security strategy.
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: www.bleepingcomputer.com
Extra Source Hub (Possible Sources for article):
https://www.quora.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
