Operation CameraSwarm: 14,530 Dahua Cameras Backdoored via P2P Exploit

Operation CameraSwarm used three parallel exploitation paths against internet-exposed Dahua devices, and none of them required a zero-day. The campaign succeeded by combining known weaknesses at scale rather than discovering new ones.

The first path was raw credential brute-forcing against port 37777, the TCP port Dahua's proprietary Easy4IP protocol uses for device management. An asyncio-based scanning engine called asleep_scanner ran up to 4,000 concurrent workers, sweeping the internet with masscan at roughly 10 million packets per second to find live Dahua devices, then password-spraying each one. This path alone reached 12,324 unique IP addresses.

The second path exploited CVE-2021-33044 and CVE-2021-33045 directly. CVE-2021-33044 is a hardware-trust bypass: when a login request specifies the NetKeyboard client type, the firmware skips password validation entirely, because devices that support NetKeyboard hardware were never expected to need a password field checked. On devices from before June 2021 that do not actually support NetKeyboard, the check is skipped anyway. CVE-2021-33045 works by source-address spoofing: the firmware reads the claimed origin address from the request body instead of the actual TCP connection, so an attacker can simply declare the request came from 127.0.0.1 (the loopback address) and be trusted as a local, already-authenticated session. Chaining these bypasses, the operator's p2pwn toolkit installed a persistent administrative account via RPC on 1,923 cameras.

The third path abused Dahua's own P2P cloud relay, the legitimate feature that lets a mobile app reach a camera behind NAT using only its serial number. Of the 283 devices reached this way, 89.4 percent required no credentials at all once the operator supplied a valid serial number pulled from a leaked or guessed batch. Recovery codes for these devices are generated entirely offline from the serial number, a design Hunt.io researchers called the strongest evidence the toolkit was built to hand off access to a third party, not merely to browse footage.

This combination of scale and simplicity is not unique to camera hardware. The same pattern, a vendor authentication bypass exploited faster than organizations can patch, drove Fortinet VPN credential leak exposure across 73,000 firewalls earlier this year.

Fourteen thousand five hundred thirty Dahua devices were compromised across the five-week campaign window, with the breakdown revealing how much damage default credentials and unpatched firmware still cause on internet-facing IoT infrastructure in 2026.

Port 37777 credential attacks reached 12,324 unique IP addresses, the largest single category, confirming that weak or reused device passwords remain the dominant initial-access vector for surveillance hardware. The CVE-2021-33044/33045 bypass chain backdoored 1,923 cameras with the persistent p2pwn account, giving the operator access that survives a password change and, on most affected firmware, a factory reset. The P2P relay path reached 283 devices behind NAT with no direct network path at all, using only a serial number, a method that bypasses firewalls and network segmentation entirely because the connection is initiated outbound by the device itself to Dahua's legitimate cloud relay.

Geographic scanning began against Russian address space before expanding globally, and confirmed compromises concentrate most heavily in Ukraine and Russia. The largest brute-force haul by ISP skewed toward Mexican and Vietnamese networks, indicating opportunistic, non-targeted scanning outside the core Russia-Ukraine concentration. Credentials harvested from compromised devices were exported to SMART PSS-compatible XML files in batches of exactly 255 devices, the vendor tool's import ceiling, evidence the operator intended to manage the compromised population at enterprise scale, likely for resale as access-as-a-service to surveillance footage or as a pivot point into connected networks.

The campaign ran for five weeks before an operational security failure exposed the entire operation. That timeline gave defenders a five-week window in which the compromise was active but undetected.

• June 17, 2026: Campaign initiation and reconnaissance begins, with initial masscan sweeps targeting Russian address space.
• June 18, 2026: Brute-force engine deployment accelerates; the largest device haul by ISP skews toward Mexican and Vietnamese networks.
• June 17 to July 22, 2026: Continuous exploitation across all three paths; 1,923 cameras receive the persistent p2pwn backdoor account via the CVE-2021-33044/33045 bypass chain.
• July 22, 2026: Final wave of exploitation activity observed.
• July 23, 2026, 11:45 UTC: The operator's staging server exposes an open directory containing 2,616 files across 234 subdirectories, 407 MB of tooling, logs, shell history, and campaign records.
• August 25 to 26, 2026: Hunt.io publishes its analysis; The Hacker News and other outlets report the campaign publicly, triggering vendor and CISA attention.

Attribution points to a Russian-speaking operator with moderate confidence, based on tool development artifacts rather than a formal actor designation. Three iterations of the serial-number brute-forcing tool show comment language evolving from Spanish-only, to mixed Spanish and Russian, to fully Russified over the campaign's five weeks, suggesting incremental handoff or adaptation rather than a single fixed author. The toolkit itself is assembled, not authored from scratch: individual components are credited to at least six separate upstream developers, and the Windows-side SalatStealer payload found on the same infrastructure has been resold across at least five unrelated campaigns, limiting its value as an attribution signal.

The operator's own tradecraft broke down at the finish line. A shell script embedded in the toolkit explicitly warned against running the tools "on the local machine," yet exposed logs showed a Windows username "SystemX" and a local path, C:\Users\SystemX\Downloads\seria, indicating the operator violated their own operational security guidance. That mistake, not a security researcher's active hunt, is what surfaced Operation CameraSwarm.

Hunt.io's discovery of the operator's exposed working directory produced a concrete, actionable IOC set, unusual for a campaign against embedded IoT devices where attacker infrastructure is typically far harder to observe directly. Prioritize the backdoor account check below; it is the single highest-confidence indicator of compromise available.

The backdoor account, username p2pwn and password p2password, is the campaign's persistence mechanism. It was installed via RPC on 1,923 cameras through the CVE-2021-33044/33045 bypass chain and is designed to survive both password changes and, on most affected firmware, a full factory reset. Check every Dahua device's user account list for this exact username regardless of whether the device shows any other sign of compromise.

Network indicators include two operator-controlled IP addresses recovered from the exposed staging directory, plus the legitimate Dahua P2P relay domain the operator abused rather than any attacker-registered infrastructure, since the P2P path routes through Dahua's own cloud service by design.

No CVE-specific community Sigma rule exists for CVE-2021-33044 or CVE-2021-33045; these are firmware-level flaws in embedded IoT devices that predate the log-source conventions most Sigma rules target. These two rules were generated by Decryption Digest from Operation CameraSwarm's documented behavior. Validate against your environment before production deployment. Both carry status: experimental.

Rule 1 targets the exact backdoor credential pair, p2pwn / p2password, wherever it appears in centralized logging from a video management system (VMS), SIEM syslog ingest from NVR/DVR devices, or network capture metadata. Because this string is a known-malicious static value with no legitimate use, a single match is high-confidence evidence of Operation CameraSwarm compromise. Rule 2 targets the CVE-2021-33044/33045 exploitation pattern itself, HTTP or RPC authentication requests carrying a NetKeyboard client-type declaration or a loopback (127.0.0.1) source-address claim inconsistent with the actual connection origin, for organizations that log Dahua device authentication traffic centrally.

The WAF rules below apply to organizations that front their Dahua device management interfaces, or a centralized VMS/NVR web console, with a reverse proxy or WAF, a common pattern for enterprises and MSPs managing surveillance fleets at scale. They detect the CVE-2021-33044 NetKeyboard bypass parameter and the CVE-2021-33045 loopback-spoof pattern in authentication request bodies. Deploy in count or log mode first to baseline legitimate NetKeyboard-hardware traffic, since a small number of environments do use genuine NetKeyboard devices, before switching to block mode.

Patching closes CVE-2021-33044 and CVE-2021-33045, but patching alone does not remove a backdoor account already installed on a compromised device. Treat every internet-exposed Dahua device as potentially compromised until you have completed both the firmware update and the account audit below.

Dahua camera vulnerability exploited at the scale of Operation CameraSwarm shows that IoT device fleets remain the most neglected corner of enterprise attack surface management. These are not obscure edge cases: Dahua and its OEM-rebranded partners supply video surveillance hardware to retailers, manufacturers, municipal governments, and critical infrastructure operators worldwide, and 14,530 confirmed compromises in five weeks is almost certainly a floor, not a ceiling, given how few organizations actively inventory camera firmware versions.

The business risk goes beyond footage exposure. A backdoored camera on an unsegmented network is a foothold for lateral movement into corporate IT, and the operator's enterprise-scale credential management (255-device XML export batches) suggests intent to resell access, not merely to browse video. Physical security teams rarely report into the same patch management process as IT, which is exactly the gap that let two five-year-old CVEs stay exploitable at scale into 2026. The underlying failure mode, an authentication bypass on internet-facing infrastructure, is the same class of exposure covered in our Check Point VPN authentication bypass analysis.

Inventory every Dahua device on your network this week. Apply the firmware update, check for the p2pwn account, and disable P2P connectivity on anything that does not need it before the weekend.