Researchers at Hunt.io reconstructed a campaign that compromised more than 14,500 Dahua cameras and related devices between June 17 and July 22, after the operator left a working directory exposed on the internet.
The 407MB haul of 2,616 files across 234 subdirectories contained the scanning engine, exploit chains, exfiltration bot, logs, and shell history behind what Hunt.io calls Operation CameraSwarm. Confirmed compromises clustered in Ukraine and Russia.
The operator used three attack paths: credential attacks against 12,324 unique IP addresses, an authentication-bypass pair (CVE-2021-33044 and CVE-2021-33045) that planted a persistent backdoor account on 1,923 cameras, and Dahua’s P2P cloud relay, which reached 283 devices purely by serial number. Nine of ten live serials probed returned an open, no-authentication channel.
Hunt.io flags that the toolkit’s CVE references are unreliable: the backdoor technique is linked to CVE-2024-39943, which actually describes a Rejetto HTTP File Server flaw, and the relay abuse is mislabeled as CVE-2025-31702. Defenders chasing the wrong advisory waste time.
The same server also staged SalatStealer, a Windows credential stealer alongside a Defender-disabling script, which the researchers treat as unrelated cargo.
For operators running Dahua hardware, the checklist starts with hunting for a p2pwn account and deleting it, then disabling P2P on devices that do not need it. Firmware should cover the 2021 bypass pair, and every credential the cameras ever held needs rotating, since the exfiltration bot collected those too. The offline account-recovery generator is the vendor’s problem to fix: it derives reset codes from serial numbers alone.
