Actor Profile

Operation CameraSwarm is a campaign disclosed by Hunt.io that compromised over 14,530 Dahua surveillance devices between June 17 and July 22, 2026. The campaign was reconstructed from a 407 MB exposed working directory containing 2,616 files across 234 subdirectories, including tooling, logs, shell history, and campaign records. The operator is assessed to be Russian-speaking based on language artifacts recovered from the working directory, but the activity has not been attributed to a named threat actor, Russian government entity, or other known group. Hunt.io assessed with moderate confidence that parts of the toolkit may have been designed to transfer camera access to a third party. The motivation appears to be mass compromise of surveillance infrastructure, with confirmed compromises concentrated in Ukraine and Russia.

TTPs (Tactics, Techniques, Procedures)

The campaign employed three distinct attack paths: (1) Credential attacks targeting 12,324 unique IP addresses across 13,229 campaign records, likely involving brute-force or credential stuffing; (2) Authentication bypass exploitation using CVE-2021-33044 (NetKeyboard client authentication bypass) and CVE-2021-33045 (loopback login request using 127.0.0.1), affecting 1,923 cameras that were configured with persistent accounts; (3) P2P relay technique exploiting Dahua's Easy4IP infrastructure, using valid serial numbers to establish relay paths before device credential checks, compromising 283 cameras behind NAT. The operator's recovered code indicated 89.4% of live serial numbers returned open channels without authentication. The persistent accounts created via CVE-2021-33044/33045 were claimed to survive factory resets on most firmware. Both CVEs are rated 9.8 CVSS by NVD and remain in CISA's KEV catalog as of August 2026.

Targets & Patterns

The campaign targeted Dahua IP cameras, network video recorders, and related surveillance products across the surveillance and security sectors. Confirmed compromises were geographically concentrated in Ukraine and Russia. The targeting pattern suggests indiscriminate mass exploitation of vulnerable Dahua devices rather than selective targeting of specific organizations. The use of P2P relay techniques enabled access to devices behind NAT, expanding the attack surface beyond directly internet-accessible cameras. The scale (14,530+ devices) and the assessment that toolkit components may transfer camera access to third parties suggests either intelligence collection objectives, preparation for future operations, or potential access-as-a-service criminal activity. The concentration in Ukraine and Russia during mid-2026 may indicate geopolitical motivations related to the ongoing regional conflict.

Historical Context

CVE-2021-33044 and CVE-2021-33045 were originally disclosed by security researcher Bashis and have been publicly known since 2021. Both vulnerabilities remain in CISA's Known Exploited Vulnerabilities catalog as of August 2026, indicating ongoing exploitation in the wild. The P2P relay exposure was previously documented by ITRES Labs during an earlier incident response investigation in October 2025, which found that firmware before mid-2024 allowed Easy4IP relay path establishment using valid serial numbers before device credential checks. ITRES Labs described this as a non-CVE issue and noted that the P2P path was reinforced in firmware released after mid-2024. The public p2pwn repository and dh-p2p proof-of-concept demonstrate that tooling for these attack vectors has been publicly available. Operation CameraSwarm represents a large-scale operationalization of these known vulnerabilities and techniques, but the campaign-specific totals and the 89.4% open-channel figure remain attributed solely to Hunt.io's analysis of recovered operator materials.

Defensive Recommendations

  • Immediately update all Dahua devices to the latest firmware from the vendor's official download site, prioritizing patches for CVE-2021-33044 and CVE-2021-33045 (CVSS 9.8, CISA KEV-listed)
  • Disable P2P/Easy4IP functionality on all Dahua devices where remote access via vendor relay infrastructure is not operationally required
  • Implement network segmentation to isolate video surveillance systems from general corporate networks and the internet, restricting management access to dedicated VLANs
  • Audit all Dahua devices for unauthorized persistent accounts created during the June-July 2026 timeframe; remove unused accounts and enforce strong unique credentials across all devices
  • Monitor for authentication attempts using NetKeyboard client types and loopback (127.0.0.1) login requests, which may indicate exploitation of CVE-2021-33044 and CVE-2021-33045
  • Restrict Easy4IP cloud connectivity at the firewall level where appropriate, and monitor for unexpected P2P relay establishment using device serial numbers