Operation CameraSwarm Hijacks 14,000 Dahua Cameras in Ukraine, Russia

Operation CameraSwarm, traced to an exposed operator directory, compromised more than 14,000 Dahua surveillance cameras in Ukraine and Russia by leveraging unauthenticated relay abuse, credential brute‑forcing, and a CVE‑2021 auth‑bypass chain, exposing the scale of IoT attack surface.

What were the three parallel exploitation paths used by the attackers?

The Hunt.io team identified three distinct techniques that ran concurrently. First, an asyncio‑based credential brute‑forcer attempted default and weak passwords across the camera fleet. Second, the actors chained CVE‑2021‑33044 and CVE‑2021‑33045 to bypass authentication on vulnerable firmware. Third, they abused a P2P relay service that authenticates only the session token, not the connecting client, allowing direct access via serial numbers.

How did an open HTTP directory enable the full reconstruction of the campaign?

On July 23, 2026, Hunt.io’s AttackCapture system crawled an unsecured HTTP server at 154.86.[.]119.60 and downloaded a 407 MB directory containing 2,616 files – the attacker’s working files, scripts, and logs. The public exposure gave researchers a complete view of tooling, infrastructure, and the step‑by‑step workflow, turning a covert operation into a forensic case study.

Why do the CVE references in the toolkit not fully explain the breach?

The operators mislabeled two CVEs. CVE‑2024‑39943 refers to an unrelated Rejetto HFS flaw, while CVE‑2025‑31702 covers a narrower post‑authentication issue. The real unauthenticated relay abuse is a separate, non‑CVE vulnerability documented by ITRES, meaning defenders cannot rely on CVE‑based patching alone to stop this vector.

What mitigation steps did Hunt.io recommend for affected organizations?

Key recommendations include: (1) Immediately block outbound traffic to the Dahua cloud relay endpoints unless required; (2) Rotate all device credentials and enforce strong, unique passwords; (3) Apply firmware updates that address CVE‑2021‑33044/33045 where available; (4) Disable unused P2P services or restrict them to trusted networks; and (5) Conduct an external attack surface scan to discover any other exposed management interfaces.

How can organizations proactively reduce the attack surface of IoT cameras?

Beyond patching, a layered approach is essential. Deploy network‑level segmentation to isolate cameras from the corporate LAN, enforce mutual TLS for any cloud‑relay communication, and regularly audit public‑facing ports using tools like GetKhojo’s AttackSurface Scanner. Continuous monitoring for anomalous traffic to known relay domains can also flag abuse early.

What does this incident reveal about the broader IoT threat landscape?

CameraSwarm underscores that misconfigurations—such as an open directory—can be as damaging as software bugs. Attackers are willing to combine multiple low‑effort techniques to achieve scale, and they exploit vendor‑specific cloud services that were not designed with zero‑trust principles. The incident also shows that threat actors can operate without a clear attribution, focusing purely on operational success.

What this means for you

If you manage or rely on IP cameras, treat any exposed management interface as a critical vulnerability. Run a comprehensive scan with GetKhojo’s privacy‑focused scanner, lock down default credentials, and verify that cloud‑relay services are either disabled or secured with strong authentication. Regularly review vendor advisories and consider a zero‑trust network design to limit lateral movement.

Frequently asked questions

How can I tell if my Dahua cameras are part of the CameraSwarm compromise?

Check for unexpected outbound connections to Dahua’s cloud relay servers, review login logs for unknown IPs, and run GetKhojo’s IoT scanner which flags devices communicating with the known relay endpoints used in the operation.

Are firmware updates enough to stop the CameraSwarm attack?

Updates that patch CVE‑2021‑33044/33045 reduce one attack vector, but the relay abuse does not rely on those CVEs. You must also disable or restrict the P2P relay service and enforce strong credentials.

What immediate steps should an organization take after discovering an open HTTP directory?

Close the directory, remove any sensitive files, rotate any exposed credentials, and conduct a forensic review of logs to determine if the files were accessed before closure.

Can network segmentation protect against camera hijacks?

Yes, placing cameras on a separate VLAN or subnet limits the impact of a compromised device and prevents attackers from easily reaching critical internal systems.

Why did the attackers use three exploitation paths at once?

Running multiple methods increases success odds; if one path fails due to a patch or configuration change, the others may still provide access, enabling large‑scale compromise.