Operation CameraSwarm compromised 14,500 Dahua devices, mostly by guessing passwords

Hunt.io documented a campaign it calls Operation CameraSwarm after finding an exposed working directory containing 2,616 files of tooling, logs and campaign records. Between June 17 and July 22, 2026 the operator compromised more than 14,530 Dahua devices. The bulk came from password-based access attempts logged across 13,229 campaign records from 12,324 unique IP addresses. A smaller set of 1,923 cameras fell to two 2021 authentication bypasses: CVE-2021-33044, which accepts crafted NetKeyboard-client packets in place of authentication, and CVE-2021-33045, which accepts login requests claiming to originate from 127.0.0.1. Those devices were given persistent accounts. A P2P relay reached a further 283 devices behind NAT, establishing the route before any login check ran. Hunt.io assessed the operator as likely Russian-speaking without naming a group. Dahua directed users to repair software or firmware updates.

Why it matters

The interesting ratio is 12,607 to 1,923: credential attacks did roughly six times the work of the CVEs. Five-year-old auth bypasses were the accelerant, not the engine. Reachable devices with weak or default passwords remain the cheapest path into a network, which is why password spraying stays at the top of every telemetry set that measures it.

Two details generalise past cameras. The loopback bypass in CVE-2021-33045 is a trust boundary drawn on a claimed source address, the same mistake as trusting X-Forwarded-For for authorization. And the P2P relay is worse than either CVE, because it establishes connectivity before authentication and leaves the login check to a web application that was never meant to face the internet. Any non-human identity that ships with an internet-reachable rendezvous service inherits that shape. Inventory what has a credential, give each device a unique one, and put appliance management planes on a segment that does not route to the internet.

Source: The Hacker News