DEV Community

Anoymask
Anoymask

Posted on

Operation CameraSwarm: Over 14,000 Dahua Cameras Compromised via Three Attack Vectors

#security #threatintel

Operation CameraSwarm: Over 14,000 Dahua Cameras Compromised via Three Attack Vectors

1. Basic Information

  • Article Title: Operation CameraSwarm: Over 14,000 Dahua cameras compromised across Ukraine and Russia
  • Publisher: Hunt.io
  • Publication Date: 2026-08-18
  • Severity: High
  • Original Source: Hunt.io
  • Related Sources: BleepingComputer
  • Related Entities: CameraSwarm, Dahua IP Camera, p2pwn, SalatStealer, CVE-2021-33044, CVE-2021-33045
  • CVE Notation Note: CVE-2024-39943 and CVE-2025-31702 found in the attack tools do not match the observed attack methods. The former is a vulnerability in a different product, and the latter is a post-authentication issue. Therefore, they are not treated as entry vectors in this report.

2. Executive Summary

This campaign compromised over 14,530 Dahua cameras using three paths in parallel: password spraying on TCP/37777, known authentication bypasses, and cloud relays accessible via serial numbers alone.

3. Attack Flow

Chain A: Credential Attacks on TCP/37777

  1. Scan TCP/37777 across the internet using masscan.
  2. Try a small list of credentials on responsive Dahua devices.
  3. Stop trying a device when a lockout response is detected.
  4. Take a snapshot after successful authentication.
  5. Filter out dark and plain images, and send useful images and credentials to Telegram.
  6. Export successfully compromised devices as an XML file for SMART PSS.

Chain B: Authentication Bypass and Persistence via Known Vulnerabilities

  1. Send CVE-2021-33044 or CVE-2021-33045 to unpatched devices.
  2. Impersonate a NetKeyboard device or spoof the source IP as 127.0.0.1 to get an administrator session.
  3. Create the p2pwn account using RPC.
  4. Reconnect after the admin password changes, or even after a factory reset on some models.
  5. Get ONVIF credentials and recover the passwords that cameras keep for NVR connections.

Chain C: Cloud Relay and Serial Number Abuse

  1. Collect potential serial numbers of Dahua devices from Shodan or DDNS names.
  2. Connect to the Dahua cloud relay using common embedded SDK credentials.
  3. Query the relay channel for a device using only its serial number.
  4. Open the channel without device-side authentication on 89.4% of the target active serial numbers.
  5. Get cloud management rights using offline-generated recovery codes.

4. Attacker Position and Execution Locations

  • The attackers scanned the entire internet from VPS and connected directly to cameras that were reachable.
  • They connected to devices behind NAT using official Dahua cloud relays.
  • Administrator sessions and persistent accounts were used on the devices.
  • SalatStealer was a separate capability on the same attack server, and no direct link to the camera compromise chain was confirmed.

5. Visibility for Victims and Administrators

  • Video services continue for users, so they may not notice the compromise.
  • For administrators, the attacks appear as many logins on TCP/37777, strange logins claiming to be NetKeyboard or loopback, and unknown p2pwn accounts.
  • Traffic via official cloud relays is hard to identify as malicious using only the source IP.

6. Success and Failure Conditions

Success Conditions

  • TCP/37777 is open to the internet, and weak or reused credentials exist.
  • Firmware is unpatched for CVE-2021-33044/33045.
  • P2P function is enabled, and serial numbers can be guessed or collected.
  • Suspicious account creation and cloud recovery processes are not monitored.

Failure Conditions

  • TCP/37777 is not exposed to the outside, and management paths are limited.
  • Patches from SA-2021-0130 or later are applied.
  • Unnecessary P2P is disabled, and the recovery code mechanism is fixed on the server side.
  • clientType=NetKeyboard and loginType=Loopback are detected and blocked.

7. What Happens on Success

  • Camera videos, device credentials, and NVR connection credentials are stolen.
  • Persistent accounts allow re-entry even after the admin password changes.
  • Compromised devices are managed in a format that allows bulk registration into SMART PSS.
  • Cloud management rights can be regained from the cloud side even after deleting accounts, as long as recovery codes are valid.

8. Observable Logs

Email

  • No emails are used in this chain.

Proxy / SWG / DNS

  • Unusual connections to easy4ipcloud.com relays. However, these share traffic with normal operations, so they cannot be judged alone.
  • Searches for many Dahua DDNS names or serial number candidates.

Endpoint / EDR

  • Bulk import of devices into SMART PSS on management PCs.
  • Unknown tools and credential files on camera management terminals. Cameras themselves often lack normal EDR.

Identity / IdP

  • Creation of unauthorized accounts like p2pwn.
  • External logins claiming to be NetKeyboard clients or 127.0.0.1.
  • Sudden increases in recovery code generation and usage.

SaaS / Cloud

  • P2P relay sessions starting from serial numbers.
  • Cloud management operations from different locations and times than normal administrators.

Network

  • Wide scans and slow credential trials on TCP/37777.
  • Logins with the Easy4IP binary protocol, snapshot fetching, and channel enumeration.
  • Direct transmission from cameras to Telegram is a strong indicator of compromise if confirmed.

9. Attack Success Determination

  • Scan Attempt Observed (Success Unconfirmed): Only scans and failed logins on TCP/37777 are confirmed.
  • User Action Confirmed: This attack does not require user action.
  • Initial Execution Confirmed: Administrator session response to authentication bypass requests is confirmed.
  • Malware Execution or Auth Success Confirmed: Successful credential login, creation of p2pwn, or established cloud relay is confirmed.
  • Data Theft or Session Compromise Confirmed: Retrieval or Telegram transmission of video, credentials, or ONVIF information is confirmed.
  • Follow-on Compromise Confirmed: Abuse of NVR credentials, bulk registration into SMART PSS, or reconnection from persistent accounts is confirmed.

10. Investigation Playbook

Trigger

  • Unauthorized p2pwn accounts, NetKeyboard/Loopback logins, external connections to TCP/37777.

Initial Check

  1. Check target models, firmware, P2P settings, and external exposure periods.
  2. Preserve authentication, account, and video access logs from June 17 to July 22, 2026.
  3. Do not assume safety just by changing the admin password.

Devices

  • Check camera account lists, configuration backups, and SMART PSS history on management PCs.
  • Rotate credentials saved in NVRs and ONVIF credentials held by cameras.

Authentication & Cloud

  • Check with vendors about recovery code generation, P2P sessions, and serial number queries.

Follow-on Actions

  • Investigate video retrieval, credential collection, lateral movement to NVRs, and reuse of the same accounts.

Containment

  • Stop external exposure, disable P2P, update to patched versions, delete unknown accounts, and change all related credentials.
  • Check with Dahua if recovery codes can be revoked, and replace or re-register devices if necessary.

Judgment Categories

  • Scan Only / Authentication Attempted / Admin Session Confirmed / Persistent Account Confirmed / Data Access Confirmed / Follow-on Access Confirmed

11. Defense and Detection Ideas

Single Events

  • Prioritize clientType=NetKeyboard, loginType=Loopback with ipAddr=127.0.0.1, and the creation of p2pwn.

Timeline Correlation

  • Correlate 37777 scans -> successful logins -> snapshot retrieval -> account creation -> P2P reconnection.

Hunting Perspectives

  • Check all Dahua/OEM devices that were exposed to the outside in June and July 2026.
  • Look for devices that still connect from the same unknown accounts even after the admin password was changed.

Log Shortages

  • Long-term camera authentication logs, P2P cloud query and recovery code logs, and video access audits are often missing.

Priority Actions

  1. Stop external exposure of TCP/37777.
  2. Update to SA-2021-0130 or later.
  3. Disable unnecessary P2P.
  4. Inspect all unauthorized accounts and saved credentials.
  5. Check procedures to revoke and reissue recovery codes.

12. Facts / Inference / Hypothesis

Facts

  • Over 14,530 units were compromised between June 17 and July 22, 2026.
  • Persistent accounts were confirmed on 1,923 units, and cloud relay access was confirmed on 283 units.
  • Successful authentication info and images were sent to Telegram and exported in SMART PSS format.
  • CVE-2024-39943 and CVE-2025-31702 in the tools do not match the observed methods.

Inference

  • The SMART PSS format and transferable recovery codes are suited for managing many compromised devices over time or handing them over to third parties.
  • Organizations globally can be compromised under the same conditions if they use Dahua or OEM devices, regardless of location.

Hypothesis

  • Unless recovery codes are revoked on the server side, re-entry may continue even after deleting known accounts.

13. MITRE ATT&CK Mapping

  • T1046 Network Service Discovery (High): Wide scans of TCP/37777.
  • T1110.003 Password Spraying (High): Trying a few credentials on many devices.
  • T1190 Exploit Public-Facing Application (High): Authentication bypass via CVE-2021-33044/33045.
  • T1136 Create Account (High): Creation of the p2pwn account.
  • T1098 Account Manipulation (High): Adding accounts for persistent access.
  • T1555 Credentials from Password Stores (Medium): Getting ONVIF/NVR credentials held by cameras.
  • T1113 Screen Capture (Medium): Similar to camera snapshot capture, but note it is not a general terminal screen.
  • T1041 Exfiltration Over C2 Channel (Medium): Treating transmission to Telegram as equivalent to C2.

14. Unknowns and Further Investigation

  • Total number of compromised units globally, official methods to revoke recovery codes, and Dahua's cloud fix status.
  • Final users of stolen videos and credentials, and whether they are sold.
  • Operational relationship between SalatStealer and the camera compromise.

15. Impact on SOCs and General Organizations

Surveillance cameras run for a long time and are outside the scope of EDR, and OEM products often hide the fact that they use Dahua infrastructure. Facilities, factories, stores, and data centers need to inventory their assets based on TCP/37777, Easy4IP, and P2P settings, not just product names. It is important to note that simply changing passwords does not remove persistent accounts and recovery codes.

16. Summaries by Target Audience

For SOCs

Check not only 37777 scans, but also NetKeyboard/Loopback logins, unknown account creation, and P2P reconnections in chronological order.

For Administrators

Stop external exposure and unnecessary P2P. Perform updates, account checks, and changes to saved credentials together.

For Users

Cameras may be compromised even if videos look normal. If you find changed settings or unknown accounts, do not just reset the camera; contact your administrator.

Top comments (0)