DEV Community

Anoymask
Anoymask

Posted on Edited on

Operation CameraSwarm: Over 14,000 Dahua Cameras Compromised via Three Attack Vectors

#security #threatintel

1. Overview

  • Article Title: Operation CameraSwarm: Over 14,000 Dahua cameras compromised across Ukraine and Russia
  • Source: Hunt.io
  • Publication Date: 2026-08-18
  • Severity: High
  • Original: Hunt.io
  • Related Sources: BleepingComputer, The Record (CERT-UA Dahua Warning), Ukraine SSSCIP/CERT-UA
  • Related Entities: CameraSwarm, Dahua IP Camera, p2pwn, SalatStealer, CVE-2021-33044, CVE-2021-33045
  • CVE Note: CVE-2024-39943 and CVE-2025-31702 found in the attack tools do not accurately reflect the observed attack methods. The former is a vulnerability in a different product, and the latter is a separate post-authentication issue; therefore, they are not treated as initial access vectors in this report.
  • Update Notes: Reflects configuration changes and unauthorized account creation cases confirmed by CERT-UA, along with the Easy4IP vector. Distinguishes methodological similarities with CameraSwarm from the lack of evidence indicating the same threat actor.

2. Executive Summary

This campaign compromised over 14,530 Dahua cameras by concurrently utilizing three vectors: password spraying against TCP/37777, known authentication bypasses, and cloud relay access reachable via serial numbers alone.

Important Update on October 27, 2026

CERT-UA confirmed compromise cases involving configuration changes and unauthorized user account creation on internet-connected Dahua cameras and video recorders. The agency warned of a vector that explores predictable serial numbers in Easy4IP, proceeding to authentication bypasses via weak or default passwords or CVE-2021-33044/33045.

Hunt.io assessed that the techniques closely resemble CameraSwarm, but there is no evidence indicating the same threat actor. CERT-UA has not disclosed the incident count, timeframe, affected organizations, or the threat actor.

3. Attack Flow

Chain A: Credential Attacks Against TCP/37777

  1. Conduct broad scanning of TCP/37777 using masscan.
  2. Test a small set of credentials against responding Dahua devices.
  3. Stop trying a device upon detecting a lockout response.
  4. Capture a snapshot upon successful authentication.
  5. Filter out dark and featureless images, then send useful images and credentials to Telegram.
  6. Export successfully compromised devices as an XML file for import into SMART PSS.

Chain B: Authentication Bypass and Persistence via Known Vulnerabilities

  1. Send CVE-2021-33044 or CVE-2021-33045 to unpatched devices.
  2. Obtain an administrator session by masquerading as a NetKeyboard device or spoofing the source IP in the request as 127.0.0.1.
  3. Create the p2pwn account via RPC.
  4. Reconnect even after administrative password changes or, depending on the model, after a factory reset.
  5. Retrieve ONVIF credentials and recover passwords stored by the cameras for NVR connections.

Chain C: Cloud Relay and Serial Number Abuse

  1. Collect serial number candidates for Dahua devices from Shodan or DDNS names.
  2. Connect to the Dahua cloud relay using SDK credentials embedded in the client.
  3. Query the relay channel for a device using only its serial number.
  4. Channels opened without device-side authentication on 89.4% of surveyed active serial numbers.
  5. Obtain cloud administrative privileges using offline-generated recovery codes.

4. Attacker Infrastructure and Execution Location

  • The attackers scanned the entire internet from VPS infrastructure and connected directly to cameras with public reachability.
  • Devices behind NAT were accessed via Dahua's official cloud relay.
  • Administrative sessions and persistent accounts were utilized directly on the devices.
  • SalatStealer was a separate capability hosted on the same attack server, and a direct connection to the camera compromise chain has not been confirmed.

5. Visibility for Victims and Administrators

  • Video services continue for users, who may remain unaware of the compromise.
  • Administrators may observe heavy login attempts against TCP/37777, unnatural logins claiming to be NetKeyboard or loopback, and unknown p2pwn accounts.
  • Traffic routed through official cloud relays is difficult to identify as malicious based solely on source IP addresses.

6. Conditions for Success and Failure

Conditions for Success

  • TCP/37777 is reachable from the internet, and weak or reused credentials exist.
  • Firmware unpatched for CVE-2021-33044/33045 is in use.
  • P2P functionality is enabled, and serial numbers can be guessed or collected.
  • Suspicious account creation and cloud recovery processes are not monitored.

Conditions for Failure

  • TCP/37777 is not exposed externally, and management paths are restricted.
  • Patched versions starting from SA-2021-0130 are applied.
  • Unnecessary P2P features are disabled, and the recovery code mechanism is redesigned on the server side.
  • clientType=NetKeyboard and loginType=Loopback are detected and blocked.

7. Impact Upon Success

  • Camera feeds, device credentials, and NVR connection credentials are obtained.
  • Re-entry is maintained via persistent accounts even after administrative password changes.
  • Compromised devices are managed in a format that allows bulk registration into SMART PSS.
  • Cloud administrative privileges can be reacquired even after account deletion as long as the recovery code remains valid.

8. Observable Logs

Email

  • Email is not used in this attack chain.

Proxy / SWG / DNS

  • Anomalous connections to easy4ipcloud.com family relays, though difficult to isolate due to shared legitimate traffic.
  • Queries for numerous Dahua DDNS names or serial number candidates.

Endpoint / EDR

  • Bulk device import into SMART PSS on management PCs.
  • Unknown tools or credential files on camera management terminals, though camera hardware typically lacks standard EDR.

Identity / IdP

  • Creation of unauthorized accounts such as p2pwn.
  • External logins claiming to be the NetKeyboard client or 127.0.0.1.
  • Spikes in the issuance and usage of recovery codes.

SaaS / Cloud

  • P2P relay sessions initiated from serial numbers.
  • Cloud management operations originating from locations and times differing from normal administrators.

Network

  • Broad scanning of TCP/37777 accompanied by low-frequency credential trials.
  • Easy4IP binary protocol logins, snapshot retrieval, and channel enumeration.
  • Direct outbound transmissions from cameras to Telegram serve as strong indicators of compromise if observed.

Additional Cloud and Account Investigation

  • Verify Easy4ip behavior enumerating multiple serial numbers, cloud relay connections from unusual locations, and the utilization of recovery codes.
  • Check for unknown accounts, privilege modifications, and accounts or recovery codes that persist after password changes or factory resets.
  • Treat configuration changes and unauthorized account creation as independent evidence of successful compromise, even in the absence of existing CameraSwarm IOCs.

9. Attack Success Determination

  • Attack Attempt Observed (Success Unconfirmed): Only scans and authentication failures against TCP/37777 are confirmed.
  • User Interaction Confirmed: This attack does not require user interaction.
  • Initial Execution Confirmed: Administrative session responses to authentication bypass requests are confirmed.
  • Malware Execution or Successful Authentication Confirmed: Credential login success, p2pwn creation, or cloud relay establishment is confirmed.
  • Data Exfiltration or Session Compromise Confirmed: Retrieval of video feeds, credentials, ONVIF information, or transmission to Telegram is confirmed.
  • Follow-on Compromise Confirmed: Exploitation of NVR credentials, bulk registration into SMART PSS, or re-access from persistent accounts is confirmed.

10. Investigation Playbook

Trigger

  • Unauthorized p2pwn accounts, NetKeyboard/Loopback logins, and external connections to TCP/37777.

Initial Verification

  1. Verify target device models, firmware versions, P2P configurations, and external exposure windows.
  2. Preserve authentication, account, and video retrieval logs from June 17 to July 22, 2026.
  3. Do not assume safety based solely on administrative password changes.

Endpoints

  • Review camera account lists, configuration backups, and SMART PSS history on management PCs.
  • Rotate credentials stored on NVRs and ONVIF credentials held by cameras.

Authentication and Cloud

  • Verify recovery code issuance, P2P sessions, and serial number inquiries with the vendor.

Follow-on Operations

  • Investigate video extraction, credential collection, lateral movement to NVRs, and reuse of identical accounts.

Containment

  • Stop external exposure, disable P2P, update to patched versions, delete unknown accounts, and change all related credentials.
  • Confirm with Dahua whether recovery codes can be revoked, and replace or re-register devices if necessary.

Determination Categories

  • Scan Only / Authentication Attempted / Admin Session Confirmed / Persistent Account Confirmed / Data Access Confirmed / Follow-on Access Confirmed

11. Defense and Detection Ideas

Single Events

  • Prioritize clientType=NetKeyboard, loginType=Loopback combined with ipAddr=127.0.0.1, and the creation of p2pwn.

Timeline Correlation

  • Correlate Port 37777 scans -> successful logins -> snapshot retrieval -> account creation -> P2P reconnections.

Hunting Perspective

  • Audit all Dahua and OEM devices that were exposed externally between June and July 2026.
  • Search for devices that continue to be accessed from unknown accounts even after administrative password changes.

Log Gaps

  • Long-term camera authentication logs, P2P cloud query and recovery code logs, and video access audit trails are frequently missing.

Prioritized Mitigations

  1. Stop external exposure of TCP/37777
  2. Update to versions starting from SA-2021-0130
  3. Disable unnecessary P2P features
  4. Audit all unknown accounts and stored credentials
  5. Verify recovery code revocation and reissue procedures

12. Facts, Inferences, and Hypotheses

Facts

  • Over 14,530 devices were compromised between June 17 and July 22, 2026.
  • Persistent accounts were identified on 1,923 devices, and cloud relay access was confirmed on 283 devices.
  • Authentication success data and images were sent to Telegram and exported in SMART PSS format.
  • References to CVE-2024-39943 and CVE-2025-31702 inside tools do not match the observed methodology.

Inferences

  • The SMART PSS format and transferable recovery codes are well-suited for maintaining large numbers of compromised devices or handing them over to third parties.
  • Organizations utilizing Dahua or OEM equipment can be compromised under identical conditions regardless of geography.

Hypotheses

  • Re-entry may persist even after deleting known accounts unless recovery codes are revoked on the server side.

13. MITRE ATT&CK Mapping

ID Technique Confidence Basis
T1046 Network Service Discovery High Broad scanning of TCP/37777.
T1110.003 Password Spraying High Testing a small set of credentials against numerous devices.
T1190 Exploit Public-Facing Application High Authentication bypass via CVE-2021-33044/33045.
T1136 Create Account High Creation of the p2pwn account.
T1098 Account Manipulation High Addition of persistent access accounts.
T1555 Credentials from Password Stores Medium Retrieval of ONVIF/NVR credentials stored by cameras.
T1113 Screen Capture Medium Closely resembles camera snapshot capture, though note this is not a standard endpoint screen.
T1041 Exfiltration Over C2 Channel Medium Treating transmissions to Telegram as equivalent to C2 exfiltration.

14. Unknowns and Further Investigation

The exact incident counts, timeframes, affected organizations, threat actors, and the relationship with CameraSwarm concerning the cases confirmed by CERT-UA remain unknown.

  • The number of domestic compromises, official revocation methods for recovery codes, and Dahua's cloud remediation status.
  • The ultimate consumers and potential resale of extracted video feeds and credentials.
  • The operational relationship between SalatStealer and the camera compromises.

15. Impact on SOCs and Organizations

Surveillance cameras operate long-term outside the scope of EDR, and their Dahua foundations in OEM hardware are easily overlooked. Facilities, factories, retail stores, and data centers must inventory their assets based not only on product names but also on TCP/37777, Easy4IP, and P2P configurations. It is crucial to recognize that simply changing passwords does not eliminate persistent accounts or recovery codes.

16. Target Audience Summaries

For SOCs

Correlate NetKeyboard/Loopback logins, unknown account creations, and P2P reconnections alongside Port 37777 scans.

For Administrators

Cease external exposure and unnecessary P2P features, and concurrently execute updates, account audits, and rotation of stored credentials.

For Users

Compromise may occur even if video feeds appear normal. If configuration changes or unknown accounts are identified, do not rely solely on a factory reset; contact administrators immediately.

Top comments (0)