Cybersecurity researchers at Hunt.io have uncovered a campaign that breached more than 14,530 Dahua surveillance devices between June 17 and July 22, 2026, using stolen credentials, two known security flaws, and a peer-to-peer relay method. The operation, which Hunt.io calls Operation CameraSwarm, was pieced together from a 407 MB exposed working directory that held 2,616 files spread across 234 subdirectories, including tools, logs, shell history, and campaign records. The confirmed breaches were concentrated in Ukraine and Russia, according to the researchers.
Hunt.io traced the total of more than 14,530 devices to three distinct attack methods. Credential attacks accounted for 12,324 unique IP addresses across 13,229 campaign records. Authentication-bypass attacks reached 1,923 cameras using CVE-2021-33044 and CVE-2021-33045, two flaws from 2021 that also received a persistent account configuration during the operation. The peer-to-peer relay path identified 283 cameras by serial number, including devices sitting behind network address translation. During the operation, 1,923 cameras received a persistent account setup, and 283 were accessed through the P2P route.
The two 2021 vulnerabilities are authentication-bypass flaws in Dahua cameras and related products. Dahua's advisory rates them 8.1 on the CVSS scoring system and lists fixed firmware, while the U.S. National Vulnerability Database currently assigns each a CVSS score of 9.8. "Attackers can bypass device identity authentication by constructing malicious data packets," Dahua said in its advisory. As of August 19, 2026, both flaws remain listed in the U.S. Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog, which records them as Dahua IP camera authentication-bypass vulnerabilities and advises applying vendor mitigations or discontinuing use if mitigations aren't available. The researchers described the operator as Russian-speaking based on language artifacts recovered from the working directory, but the activity hasn't been attributed to a named threat actor, a Russian government entity, or another known group.
The P2P path operates separately from the two authentication-bypass flaws. ITRES Labs found during an earlier incident response investigation that, on firmware before mid-2024, a valid Dahua serial number could be used to set up an Easy4IP relay path before the connected device ran its own credential check, allowing a device behind NAT to become reachable through the vendor's relay infrastructure. "The relay establishes the route without prior authentication, leaving login checks to the device's web application," ITRES Labs said in an analysis published in October 2025. Hunt.io said the operator's recovered code recorded 89.4% of live serial numbers returning an open channel without authentication, though that figure remains a campaign-specific claim from the recovered operator material and hasn't been independently reproduced by ITRES Labs, Dahua, or a public computer emergency response team advisory located as of August 19, 2026. ITRES Labs described the serial-number relay exposure as a non-CVE issue and said its testing found that the P2P path was reinforced in firmware released after mid-2024.
Users of affected Dahua products are advised to install the corresponding fix software or newer firmware, while ITRES Labs recommends disabling P2P where it isn't required and checking firmware against the vendor's download site. The firm also advised defenders to restrict Easy4IP connectivity where appropriate, use strong unique credentials, remove unused accounts, and segment video surveillance systems. Dahua's advisory directs customers to install the listed repair software or newer firmware. The Hacker News has reached out to Dahua to confirm the campaign scope and P2P findings. Organizations relying on internet-connected surveillance hardware face a persistent tension between remote accessibility and exposure, particularly when legacy protocols assume devices will authenticate before network paths open. Vendors who built cloud relay features into millions of shipped units now confront the operational reality that retrofitting authentication into those paths requires coordinating firmware updates across installations that may never connect to update servers.