Threat intelligence company Hunt.io uncovered a wide-ranging campaign that researchers dubbed CameraSwarm, during which attackers compromised 14,530 Dahua IP cameras over a period of at least 35 days, between June 17 and July 22, 2026. The affected devices were concentrated largely in Russia and Ukraine, although the scanning operation began from Russian address ranges before expanding to the entire IPv4 space.
Researchers discovered the campaign after finding an exposed working directory on an HTTP server that the operator had left unprotected. The directory made it possible to recover 407 megabytes of data distributed across 2,616 files and 234 directories, including source code, logs, credentials, images captured from the cameras, command history, and exploit results. These materials helped reconstruct the attack mechanisms and the scale of the activity.
Three Intrusion Paths
The campaign operated through three parallel methods. One system used brute-force attempts to scan TCP port 37777 and successfully compromised devices associated with 12,324 unique IP addresses. The system also captured images from the cameras and sent the results to Telegram, exporting them in a format that could be used with Dahua's SMART PSS platform.
Another path exploited CVE-2021-33044 and CVE-2021-33045 using a tool called p2pwn. The tool installed a backdoor account named p2pwn with the password p2password on 1,923 cameras. According to Hunt.io, this account remains in place after the password is changed and, on most firmware versions, persists even after a factory reset.
The third path targeted 283 cameras behind devices using NAT through a cloud relay, leveraging serial numbers and SDK credentials embedded in Dahua applications. The data analyzed by the researchers indicates that 89.4% of exposed live serial numbers enabled an unauthenticated access channel.
The Risk of Recovery Tokens
The risk is not limited to the backdoor account. The attack tools exploited a recovery-token generation mechanism based on the camera's serial number, allowing the operator to request new tokens through Dahua's standard password-recovery process without knowing the current administrator password. The tools also contained two misleading references to CVE-2024-39943 and CVE-2025-31702, but the researchers found no evidence that they were exploited in the observed attacks.
What Should Camera Owners Do?
Hunt.io notified national incident response teams and Dahua's PSIRT about the campaign on August 10, 2026. The company recommends treating Dahua cameras that were accessible through port 37777 during June and July as compromised, then checking them for and deleting the p2pwn account.
However, deleting the account does not invalidate the recovery tokens created by the campaign's tools; they remain usable until Dahua changes the derivation mechanism on the server. Therefore, P2P should also be disabled when it is not needed, and firmware updates listed in bulletin Dahua SA-2021-0130 should be installed to address CVE-2021-33044 and CVE-2021-33045, or users should upgrade to a newer version.