Cybersecurity researchers at **Hunt.io** have disclosed details of a campaign that they say compromised more than 14,530 **Dahua** devices between June 17 and July 22, 2026, using credential attacks, two authentication-bypass flaws, and a peer-to-peer (P2P) relay technique.  The activity, codenamed Operation **CameraSwarm**, was reconstructed from a 407 MB exposed working directory containing 2,616 files across 234 subdirectories. This trove included tooling, logs, shell history, and campaign records, with researchers stating that confirmed compromises were concentrated in Ukraine and Russia. **Hunt.io** attributed the 14,530-plus total to three primary attack paths: * **Credential attacks:** Targeting 12,324 unique IP addresses across 13,229 campaign records. * **Authentication bypass:** Exploiting **CVE-2021-33044** and **CVE-2021-33045** to compromise 1,923 cameras, which were also configured with a persistent account. * **P2P relay:** Identifying 283 cameras by serial number, including devices located behind Network Address Translation (NAT). ### Exploiting Known Vulnerabilities The two 2021 flaws, **CVE-2021-33044** and **CVE-2021-33045**, are authentication-bypass vulnerabilities affecting **Dahua** cameras and related products. **Dahua**'s advisory rates them 8.1 on the CVSS scoring system and lists fixed firmware. The **U.S. National Vulnerability Database (NVD)** currently assigns each a CVSS score of 9.8. "Attackers can bypass device identity authentication by constructing malicious data packets," **Dahua** stated in its advisory. According to the original disclosure from security researcher **Bashis**, **CVE-2021-33044** is triggered by a **NetKeyboard** client type during authentication, while **CVE-2021-33045** involves a loopback login request using the 127.0.0.1 address. As of August 19, 2026, both flaws remain listed in the **U.S. Cybersecurity and Infrastructure Security Agency's (CISA) Known Exploited Vulnerabilities (KEV)** catalog. **CISA** advises applying vendor mitigations or discontinuing use if mitigations are unavailable. ### The P2P Relay Technique **ITRES Labs** noted in an analysis that the P2P relay establishes a route without prior authentication, leaving login checks to the device's web application. During the operation, 283 cameras were reached through this P2P path, with **Hunt.io** reporting that 89.4% of live serial numbers returned an open channel without authentication. **ITRES Labs** found that on firmware released before mid-2024, a valid **Dahua** serial number could establish an **Easy4IP** relay path before the connected device performed its own credential check, making devices behind NAT reachable through **Dahua**'s relay infrastructure. Proof-of-concept repositories like `p2pwn` and `dh-p2p` independently confirm that the **Dahua** P2P protocol can locate a device via **Easy4IPCloud** using its serial number and establish a tunnel to the camera or network video recorder. ### Recommendations for Defenders Users of affected **Dahua** products are strongly advised to install the corresponding fix software or newer firmware. **ITRES Labs** recommends disabling P2P where it is not required and regularly checking firmware against the vendor's download site. Specifically, **ITRES Labs** advised defenders to: * Disable P2P unless absolutely necessary. * Restrict **Easy4IP** connectivity where appropriate. * Update devices using firmware from the vendor's official website. * Utilize strong, unique credentials. * Remove any unused accounts. * Segment video surveillance systems from the main network.  ### Attribution and Scope **Hunt.io** described the operator as Russian-speaking based on language artifacts recovered from the working directory, though the activity has not been attributed to a named threat actor or government entity. The firm assessed with moderate confidence that parts of the toolkit may have been designed to transfer camera access to a third party. As of August 19, 2026, the campaign-specific totals reported by **Hunt.io** — over 14,530 devices, 1,923 persistent accounts, 283 P2P compromises, and the 89.4% open-channel figure — remain attributed solely to their findings. Public primary sources corroborate the existence of the two authentication bypasses, the `p2pwn` tool configuration, and the underlying serial-number P2P mechanism, but do not independently confirm the specific **CameraSwarm** counts.