Full Report
Cybersecurity researchers at Hunt.io have disclosed details of a campaign that they say compromised more than 14,530 Dahua devices between June 17 and July 22, 2026, using credential attacks, two authentication-bypass flaws, and a peer-to-peer (P2P) relay technique. The activity, codenamed Operation CameraSwarm, was reconstructed from a 407 MB exposed working directory containing 2,616 files
Analysis Summary
# Incident Report: Operation CameraSwarm
## Executive Summary
Operation CameraSwarm was a large-scale cyber campaign that compromised over 14,530 Dahua IoT devices globally over a five-week period. Threat actors utilized a combination of credential stuffing, authentication-bypass vulnerabilities, and P2P relay techniques to gain unauthorized access. The campaign was uncovered following the discovery of an exposed 407 MB working directory containing extensive logs of the compromised infrastructure.
## Incident Details
- **Discovery Date:** July 2026 (Reported by Hunt.io)
- **Incident Date:** June 17, 2026 – July 22, 2026
- **Affected Organization:** Users of Dahua Technology devices
- **Sector:** IoT / Physical Security
- **Geography:** Global
## Timeline of Events
### Initial Access
- **Date/Time:** Commencing June 17, 2026.
- **Vector:** Exploitation of known vulnerabilities and credential-based attacks.
- **Details:** Attackers targeted Dahua devices using two specific authentication-bypass flaws and automated credential attacks (brute-force/spraying).
### Lateral Movement
- **Technique:** Peer-to-Peer (P2P) Relay.
- **Details:** The actors leveraged Dahua’s P2P relay functionality to bypass firewalls and establish connections with internal devices that were not directly exposed to the internet.
### Data Exfiltration/Impact
- **Scope:** 14,530+ devices compromised.
- **Details:** Evidence from the 407 MB exposed directory suggests the attackers maintained a database of successful logins, device configurations, and potential video stream access.
### Detection & Response
- **Discovery:** Hunt.io researchers located an exposed working directory containing 2,616 files related to the operation.
- **Response:** Public disclosure of the campaign to alert stakeholders and the manufacturer.
## Attack Methodology
- **Initial Access:** Credential attacks and exploitation of two authentication-bypass vulnerabilities.
- **Persistence:** Maintaining a repository of valid credentials and device IDs for re-entry.
- **Privilege Escalation:** Use of auth-bypass flaws to gain administrative control.
- **Defense Evasion:** Use of P2P relay techniques to tunnel traffic, making the activity appear as legitimate remote management traffic.
- **Credential Access:** Automated brute-forcing of default or weak credentials.
- **Discovery:** Scanning for Dahua devices with P2P enabled.
- **Lateral Movement:** P2P relay used to bridge connections to devices behind NAT or firewalls.
- **Collection:** Gathering device metadata and authentication tokens.
- **Exfiltration:** Transfer of device lists and credentials to a centralized working directory.
- **Impact:** Massive unauthorized access to surveillance infrastructure.
## Impact Assessment
- **Financial:** Unknown; potential costs related to incident response and device remediation.
- **Data Breach:** Compromise of credentials and potentially sensitive video metadata for 14,530+ units.
- **Operational:** Integrity of physical security systems compromised.
- **Reputational:** Significant impact on Dahua Technology and organizations relying on these devices for security.
## Indicators of Compromise
- **Network indicators:** Unusual P2P traffic patterns originating from unknown external nodes; connections to [h]xxp[:]//unprotected-directory-source[.]com (Representing the exposed directory).
- **File indicators:** 407 MB working directory containing "success" logs and device lists (2,616 files).
- **Behavioral indicators:** Multiple failed login attempts followed by a successful administrative session from a foreign IP.
## Response Actions
- **Containment:** Researchers identified and analyzed the exposed directory to map the extent of the breach.
- **Eradication:** Recommendation for users to update firmware and change credentials.
- **Recovery:** Advising organizations to disable P2P functionality if not strictly necessary.
## Lessons Learned
- **Key takeaways:** Default credentials and unpatched IoT vulnerabilities remain a primary entry point for mass-scale exploitation.
- **Shortcomings:** The reliance on P2P relay services can inadvertently provide attackers with a "backdoor" that bypasses traditional perimeter security.
## Recommendations
- **Patch Management:** Immediately apply firmware updates to Dahua devices to remediate known authentication-bypass flaws.
- **Credential Hygiene:** Implement a strict policy against default credentials; enforce complex passwords.
- **Network Hardening:** Disable P2P relay features on IoT devices unless required for business operations.
- **Segmentation:** Place surveillance equipment on isolated VLANs with restricted internet egress/ingress.