A massive 35-day cyberattack dubbed 'CameraSwarm' has compromised over 14,500 Dahua IP cameras, primarily targeting users in Russia and Ukraine through advanced exploitation techniques.

  • Over 14,530 Dahua IP cameras were compromised during the 35-day campaign.
  • Attackers used brute-forcing, CVE exploitation, and cloud-relay methods.
  • A persistent backdoor account 'p2pwn' was installed on nearly 2,000 devices.
  • The campaign targeted Russian and CIS telecom netblocks extensively.

In a staggering breach of digital and physical privacy, cybersecurity researchers have uncovered a massive hacking campaign known as 'CameraSwarm'. The operation, which lasted from June 17 to July 22, successfully compromised more than 14,500 Dahua IP cameras. The campaign was primarily focused on IP addresses within Russia and Ukraine, marking a significant escalation in IoT-targeted warfare.

The threat intelligence firm Hunt.io discovered the campaign after stumbling upon an unprotected HTTP server belonging to the operator. This oversight allowed researchers to recover 407 MB of critical data, including source code, logs, credentials, and even captured images from the compromised cameras, providing a clear blueprint of the attackers' sophisticated methodology.

Read Also:Critical Vulnerability Discovered in Ruby on Rails: Potential for Remote Code Execution

The Three-Pronged Attack Strategy

The CameraSwarm attackers did not rely on a single method; instead, they utilized three distinct attack vectors in parallel to maximize their reach:

  • Brute-Force Scanning: By scanning TCP port 37777, attackers compromised 12,324 unique IP addresses. They utilized snapshots of camera feeds and transmitted them via Telegram.
  • Vulnerability Exploitation: Using a specialized tool called 'p2pwn', hackers exploited CVE-2021-33044 and CVE-2021-33045. This allowed them to install a persistent backdoor account that survives even factory resets on most firmware versions.
  • Cloud-Relay Attack: By leveraging serial numbers and embedded SDK credentials, attackers bypassed NAT protections to reach 283 cameras, exploiting the fact that nearly 90% of exposed serials lacked authentication.

Why This Matters

BozokMedia analysis shows that this is not just a data breach, but a fundamental failure of IoT security architecture. When IP cameras are compromised, the boundary between the digital world and physical reality dissolves, allowing malicious actors to monitor private lives and sensitive industrial operations in real-time.

The ability of attackers to generate recovery codes using only serial numbers highlights a catastrophic flaw in the standard password-recovery ecosystem.

One of the most alarming aspects of the CameraSwarm toolkit is its ability to circumvent standard security measures. The attackers could generate new recovery codes using a camera's serial number, effectively allowing them to hijack the device even if the administrator changed the password. This renders traditional password updates largely ineffective against this specific threat actor.

Did You Know?: The 'p2pwn' backdoor account is so deeply embedded that simply resetting your camera to factory settings may not remove the hacker's access.
Attack MethodTargeted DevicesPrimary Tool/Vulnerability
Brute-Force12,324TCP Port 37777
Exploitation1,923p2pwn / CVE-2021-33044
Cloud-Relay283Serial Number/SDK Credentials

Frequently Asked Questions

1. What should Dahua camera owners do immediately?
Check for an unauthorized 'p2pwn' account, disable P2P if not needed, and immediately update to the latest Dahua firmware (SA-2021-0130 or later).

2. Can a factory reset fix the hack?
Not necessarily. The 'p2pwn' backdoor and the serial-based recovery code mechanism may persist even after a factory reset.