Full Report
In a large-scale campaign that researchers dubbed CameraSwarm, hackers compromised more than 14,500 Dahua IP cameras mostly in Ukraine and Russia. [...]
Analysis Summary
# Incident Report: Operation CameraSwarm
## Executive Summary
Operation CameraSwarm was a large-scale, 35-day cyber campaign that compromised over 14,500 Dahua IP cameras globally, with a primary focus on Russia and Ukraine. The attackers utilized a combination of brute-forcing, exploitation of known vulnerabilities, and cloud-relay attacks to gain unauthorized access and install persistent backdoors. The discovery of an unprotected directory by researchers led to the identification of the toolkit and the scope of the breach.
## Incident Details
- **Discovery Date:** August 10, 2026 (Notification to CERTs)
- **Incident Date:** June 17, 2024 – July 22, 2024 (Active campaign duration)
- **Affected Organization:** Users of Dahua IP cameras
- **Sector:** IoT / Physical Security
- **Geography:** Global (Concentrated in Russia, Ukraine, and CIS regions)
## Timeline of Events
### Initial Access
- **Date/Time:** Commencing June 17, 2024
- **Vector:** Multiple vectors including Brute-forcing (TCP port 37777), exploitation of CVE-2021-33044/33045, and cloud-relay serial number exploitation.
- **Details:** The attackers scanned the entire IPv4 range, focusing on Russian and CIS telecom netblocks.
### Lateral Movement
- **Details:** The report primarily focuses on the compromise of edge IoT devices. While traditional lateral movement through a corporate network isn't detailed, the "cloud-relay" method allowed attackers to bypass NAT to reach cameras on internal networks.
### Data Exfiltration/Impact
- **Details:** Exfiltration of camera snapshots, source code, logs, credentials, and shell history. Over 407 MB of data across 2,616 files was recovered from the attacker's staging server.
### Detection & Response
- **Detection:** Discovered by Hunt.io researchers via an unprotected HTTP server directory left exposed by the operator.
- **Response:** Notification sent to national CERTs and Dahua’s PSIRT on August 10, 2026.
## Attack Methodology
- **Initial Access:** Brute-forcing, credential stuffing, and vulnerability exploitation.
- **Persistence:** Creation of a hidden backdoor account named `p2pwn` with the password `p2password`.
- **Privilege Escalation:** Use of offline recovery codes generated from serial numbers to reset admin access.
- **Defense Evasion:** Use of legitimate Dahua SDK credentials and cloud-relay services to bypass NAT/Firewalls.
- **Credential Access:** Brute-forcing TCP 37777 and leveraging SDK-embedded credentials.
- **Discovery:** Global IPv4 scanning and specific targeting of Russian/CIS netblocks.
- **Collection:** Automated capturing of usable camera snapshots and exporting data for the SMART PSS platform.
- **Impact:** Unauthorized surveillance and persistent device control.
## Impact Assessment
- **Financial:** Unknown; potential costs related to remediation and firmware patching for 14,500+ devices.
- **Data Breach:** Exposure of live video feeds/snapshots and device metadata.
- **Operational:** Potential loss of control over physical security infrastructure.
- **Reputational:** Significant impact on trust for IoT devices utilizing P2P cloud services.
## Indicators of Compromise
- **Network:** Scanning activity targeting TCP port 37777.
- **File/Account:** Presence of a local user account named `p2pwn`.
- **Behavioral:** Unauthorized snapshots being sent to Telegram bots or external IPs.
## Response Actions
- **Containment:** Disabling P2P cloud functionality on affected devices.
- **Eradication:** Removal of the `p2pwn` account and application of firmware updates (SA-2021-0130).
- **Recovery:** Restoration of device integrity via firmware flashing; however, researchers note that server-side changes are needed to invalidate leaked recovery codes.
## Lessons Learned
- **IoT Vulnerability:** Older vulnerabilities (from 2021) remain highly effective if devices are not patched.
- **Recovery Mechanisms:** Password recovery logic based solely on serial numbers presents a significant architectural risk.
- **Operational Security (OPSEC):** The attacker’s failure to secure their own HTTP server led to the total exposure of the campaign.
## Recommendations
- **Patch Management:** Immediately apply Dahua firmware updates for CVE-2021-33044 and CVE-2021-33045.
- **Hardening:** Disable P2P and cloud-relay features if they are not strictly required for business operations.
- **Access Control:** Change default credentials and implement strong, unique passwords for all IoT devices.
- **Network Segmentation:** Place IP cameras on a dedicated VLAN with restricted outbound internet access.