# Ukrainian CERT Warns of Compromised Dahua Surveillance Cameras **CERT-UA**, Ukraine's computer emergency response team, has alerted IT security professionals and privacy-conscious users to a significant threat: hackers are gaining unauthorized access to surveillance cameras and video recorders manufactured by Chinese vendor **Dahua Technology**. Late last week, **CERT-UA** reported identifying multiple instances where internet-connected **Dahua** devices were compromised. Attackers manipulated settings and created rogue user accounts, potentially exposing critical video feeds and granting remote control capabilities. While the agency did not disclose the scale or timing of these attacks, nor identify the responsible parties, the prevalence of Chinese-made surveillance equipment within Ukraine, including in governmental and military sectors, amplifies the severity of the warning. ## Exploiting Cloud Access: The Easy4IP Vulnerability The primary vector for these attacks appears to be **Dahua**'s **Easy4IP** feature. This functionality allows users to remotely access their cameras via the manufacturer's cloud service, connecting devices using their serial numbers even when protected by firewalls or without direct internet exposure. **CERT-UA** highlighted that these serial numbers follow predictable patterns, enabling attackers to guess and identify large numbers of cameras connected to the cloud. This means devices with **Easy4IP** enabled are vulnerable even if their serial numbers have never been publicly disclosed. Once a device is identified, attackers can attempt to gain access by exploiting weak or default passwords, or by leveraging known security flaws in outdated firmware to bypass authentication. Specifically, **CERT-UA** pointed to two critical vulnerabilities disclosed in 2021: **CVE-2021-33044** and **CVE-2021-33045**, which affect certain **Dahua** cameras and video recorders. ## Echoes of Previous Campaigns This warning resonates with earlier findings. In August, cybersecurity firm **Hunt.io** reported on 'Operation CameraSwarm', detailing how hackers compromised over 14,500 **Dahua** devices earlier in the summer, with concentrations in Ukraine and Russia. While the exact link between the **Hunt.io** findings and **CERT-UA**'s current warning remains unconfirmed, **Hunt.io** noted a strong resemblance in the attack methodologies. The servers used in the 'Operation CameraSwarm' campaign are still active, though researchers haven't found new copies of the attackers' toolkit since July. **Hunt.io** cautions that the absence of new evidence does not equate to a cessation of attacks, as the threat actors may have simply restricted access to their operational files. **Hunt.io** further warned that compromised cameras could remain accessible to attackers for months, as malicious accounts and recovery codes often persist even after password changes and, in most firmware versions, factory resets. Securing these devices effectively requires a firmware update, not just account removal. ## Dahua's Broader Scrutiny **Dahua Technology** is a major global player in video surveillance, producing cameras, recording systems, and facial recognition technology. The company has faced restrictions in the United States due to national security and human rights concerns. In 2018, the U.S. Congress prohibited federal agencies from procuring certain **Dahua** equipment, and in 2019, Washington placed the company on a trade blacklist over its alleged involvement in the surveillance and repression of Uyghurs in China's Xinjiang region. ## Surveillance Risks in Wartime Ukraine This latest warning from **CERT-UA** underscores long-standing concerns in Ukraine regarding the potential exploitation of surveillance cameras by Russian intelligence services to monitor military movements and critical infrastructure. Earlier this month, The Wall Street Journal reported that Ukraine's domestic security agency, the **SBU**, has identified and secured approximately 40,000 surveillance cameras since the full-scale Russian invasion began in 2022, precisely due to fears of military intelligence gathering. In January 2024, the **SBU** revealed that Russian intelligence services had hacked two cameras on residential buildings in Kyiv, reconfiguring them to monitor air defense activities and critical infrastructure, streaming footage to YouTube. A 2024 investigation by Radio Free Europe/Radio Liberty found around 24,000 cameras from **Dahua** and **Hikvision** installed in municipal surveillance systems across Ukraine. Despite ongoing security concerns, Ukrainian public procurement records indicate continued purchases of **Dahua** equipment by government institutions and military units as recently as 2026. It is currently unclear whether any of the devices highlighted in **CERT-UA**'s recent warning belong to Ukrainian government agencies or military organizations.