Hackers Compromise 14,500 Dahua Web Cameras in 35-Day Campaign

Introduction

In a massive 35-day campaign dubbed "CameraSwarm," hackers compromised over 14,500 Dahua IP cameras across multiple countries, primarily in Ukraine and Russia. The attackers used a combination of brute-force attacks, known vulnerabilities, and a sophisticated serial number recovery code technique to gain access.

Security researchers at Hunt.io discovered the campaign after finding an unprotected HTTP server directory containing 407 MB of data — including source code, logs, credentials, and captured camera images.

The CameraSwarm Campaign: What Happened

The operation ran from June 17 to July 22, 2026 — at least 35 days of continuous attacks. The attackers used three parallel methods to compromise devices:

• Brute-forcing — scanning TCP port 37777 and attempting login combinations
• Exploiting known vulnerabilities — CVE-2021-33044 and CVE-2021-33045
• Cloud-relay attacks — using serial numbers to generate recovery codes

Hunt.io recovered a massive amount of evidence from the unprotected server:

• 407 MB of data
• 2,616 files across 234 directories
• Source code, logs, credentials, camera snapshots, and shell history

Three Attack Methods Used in Parallel

1. Brute-Force Attack (12,324 Devices)

The attackers scanned TCP port 37777 and compromised 12,324 unique IP addresses using brute-force login attempts. They captured camera snapshots, sent results to Telegram, and exported them for Dahua's SMART PSS platform.

2. Exploiting Known Vulnerabilities (1,923 Devices)

Using a tool called p2pwn, the attackers exploited CVE-2021-33044 and CVE-2021-33045 — two known vulnerabilities in Dahua cameras. This compromised 1,923 cameras and installed a persistent backdoor account.

3. Cloud-Relay Attack (283 Devices)

The most sophisticated method involved a cloud-relay attack that compromised 283 cameras behind NAT. The attackers used only the camera's serial number and embedded SDK credentials to gain access.

The p2pwn Backdoor Account

The most concerning aspect of this campaign is the persistent backdoor account installed by the attackers:

• Username: p2pwn
• Password: p2password
• Persistence: The account survives password changes
• Factory reset: On most firmware versions, the account survives factory resets

The Cloud-Relay Attack

The cloud-relay attack method is particularly sophisticated:

• Uses only the camera's serial number — no password needed
• Recovery code generation — the toolkit leverages the camera serial number to generate valid recovery codes
• Bypasses Dahua's password recovery process — without knowing the current admin password
• 89.4% of live serials exposed an access channel without authentication

Even after removing the backdoor account, the recovery codes generated by the toolkit remain usable until Dahua changes the recovery code derivation process on the server side.

How to Protect Your Dahua Cameras

If you own Dahua cameras, follow these steps immediately:

• Check for the p2pwn account. Log into your camera and check for the presence of a "p2pwn" user account. If found, remove it.
• Update your firmware. Apply the Dahua SA-2021-0130 firmware updates for CVE-2021-33044 and CVE-2021-33045, or a later firmware version.
• Disable P2P when not needed. Turn off the P2P feature if you don't require remote access.
• Change default passwords. Ensure all cameras have strong, unique passwords.
• Monitor for unusual activity. Check for unauthorized access attempts or unexpected user accounts.
• Block port 37777 at the firewall. If you don't need external access, block this port.
• Use a VPN for remote access. Instead of exposing cameras directly to the internet, use a VPN.
• Regularly audit camera settings. Check for any unauthorized changes or new accounts.

Important note: Removing the backdoor account does not invalidate recovery codes generated by the toolkit. The codes remain usable until Dahua changes the recovery code derivation system server-side.

Final Thoughts

The CameraSwarm campaign demonstrates that IoT devices remain a major security risk. Attackers are actively scanning for vulnerable cameras, and the combination of brute-force attacks, known vulnerabilities, and serial number exploitation makes these devices easy targets.

Key takeaways:

• 14,500+ Dahua cameras were compromised in 35 days
• Attackers used brute-force, known vulnerabilities, and serial number attacks
• The p2pwn backdoor account survives password changes and factory resets
• Recovery codes generated from serial numbers remain valid
• Update firmware, disable P2P, and block port 37777 immediately
• Treat all IoT devices as potential security risks

If you need help securing your IoT devices or want to learn more about protecting your business from these threats, contact SystemLogicIT for a free security assessment.