Threat intelligence company **Hunt.io** has uncovered a significant cyberattack campaign, 'CameraSwarm,' which saw hackers gain control over thousands of **Dahua** IP cameras. The operation, active between June 17 and July 22, involved a blend of attack vectors to achieve widespread compromise. ### Discovery and Data Recovery The campaign came to light after **Hunt.io** researchers discovered an unprotected working directory on an HTTP server used by the attackers. This oversight allowed them to recover 407 MB of data, including source code, logs, credentials, captured camera images, and exploitation results. This trove of information provided crucial insights into the scale and methodology of the 'CameraSwarm' operation. ### Multi-Vector Attack Chain **Hunt.io**'s analysis revealed three primary attack methods employed in parallel during the 35-day campaign, affecting 14,530 **Dahua** IP cameras: 1. **Brute-Forcing:** A dedicated system scanned TCP port 37777, compromising devices at 12,324 unique IP addresses. This system not only captured camera snapshots but also relayed results to **Telegram** and exported them for **Dahua**'s SMART PSS platform. 2. **Vulnerability Exploitation:** Attackers utilized a tool named `p2pwn` to exploit **CVE-2021-33044** and **CVE-2021-33045**. This resulted in the installation of a persistent backdoor account (`p2pwn` / `p2password`) on 1,923 cameras. This backdoor account is notably resilient, surviving password changes and, in most firmware versions, even factory resets. 3. **Cloud-Relay Attack:** This method targeted 283 cameras situated behind NAT, leveraging only serial numbers and SDK credentials embedded in **Dahua** applications. Analysis showed that 89.4% of live serial numbers exposed an access channel without requiring authentication. ### Exploiting Password Recovery Mechanisms The attack toolkit also included a mechanism to generate recovery codes by leveraging the camera's serial number. This allowed the 'CameraSwarm' operator to bypass the need for the current administrator password and redeem new codes through **Dahua**'s standard password-recovery process. Interestingly, the toolkit contained references to two misleading vulnerability identifiers, **CVE-2024-39943** and **CVE-2025-31702**, which were not observed being exploited in the actual attacks.  *Source: Hunt.io* ### Geographic Focus and Attribution Clues While initial scanning was global, covering the entire IPv4 range, **Hunt.io** noted that the operator's focus ultimately narrowed to Russian and CIS telecom network blocks. Further analysis of modified public tools used in the campaign revealed the presence of Russian comments in the code, offering potential clues regarding the attackers' origin. ### Recommendations for Mitigation **Hunt.io** notified national CERTs and **Dahua**'s PSIRT about the 'CameraSwarm' campaign on August 10. Owners of **Dahua** cameras that were reachable via port 37777 between June and July should consider their devices potentially compromised. It is crucial to: * Examine cameras for the presence of a 'p2pwn' account and remove it immediately. * Be aware that removing the backdoor account does not invalidate recovery codes generated by the toolkit; these remain usable until **Dahua** alters the derivation process server-side. * Disable P2P functionality when not actively needed. * Apply **Dahua** SA-2021-0130 firmware updates for **CVE-2021-33044** and **CVE-2021-33045**, or update to a later firmware version.