A sophisticated threat actor behind 'Operation CameraSwarm' has compromised over 14,000 Dahua IP cameras across Russia and Ukraine, installing persistent backdoors that survive factory resets.

  • 'Operation CameraSwarm' targeted over 14,000 Dahua IP cameras between June and July.
  • Attackers deployed a persistent backdoor (p2pwn/p2password) that survives factory resets.
  • The campaign exploited three specific vulnerabilities, including CVE-2021-33044 and CVE-2021-33045.
  • The primary targets were Russian and CIS telecom netblocks.

In a major breach of internet-of-things (IoT) security, a massive hacking campaign known as Operation CameraSwarm has compromised more than 14,000 Dahua IP cameras. According to a report by Hunt.io, the campaign specifically targeted devices located within Ukraine and Russia, focusing heavily on Russian and CIS (Commonwealth of Independent States) telecom netblocks between June 17 and July 22.

The attackers utilized a brute-force engine to target over 12,000 unique addresses. Most alarmingly, the threat actor successfully deployed a persistent backdoor account on 1,923 cameras via Remote Procedure Call (RPC). This backdoor uses the credentials p2pwn/p2password and, crucially, remains active even if the administrator changes the password or performs a factory reset on the device.

Read Also:JadePuffer: First Fully LLM‑Powered Ransomware Attack Exploits Langflow Flaw

Technical Sophistication and Vulnerabilities

The technical execution of this attack was highly advanced. Rather than relying on a single exploit, the attackers chained three distinct vulnerabilities: CVE-2021-33044, CVE-2021-33045, and CVE-2024-39943. By exploiting unconditional trust in client identification and flaws in how firmware reads source addresses, the attackers were able to bypass authentication entirely and gain full administrator sessions.

The ability of this backdoor to survive a factory reset represents a catastrophic failure in standard IoT recovery protocols.

Why This Matters

BozokMedia analysis shows that this is not merely a localized data breach but a significant geopolitical security event. By gaining access to thousands of cameras in conflict-sensitive regions like Ukraine and Russia, the threat actor has essentially established a massive, distributed surveillance network. The ability to bypass NATs using Dahua’s cloud relay further demonstrates the attackers' ability to penetrate even well-protected networks.

Furthermore, the infrastructure for this campaign was prepared at least a year in advance. The toolkit used by the hackers contains a mix of custom-written code and modified code from at least four other developers, suggesting a highly organized and professional operation, possibly aimed at providing access to a third-party entity.

Did You Know?: Many IoT devices use 'hardcoded' credentials or vulnerabilities in their firmware that are often left unpatched for years, making them permanent targets for automated botnets.

Frequently Asked Questions

1. Can I secure my Dahua camera if it has been targeted?
Since the backdoor survives a factory reset, simply resetting the device may not be enough. Users should check for official firmware patches from Dahua immediately.

2. What was the primary method used to bypass security?
The attackers used a compiled Go binary to chain multiple vulnerabilities that allowed them to bypass authentication and gain admin access without a password.