Operation CameraSwarm compromises over 14,500 Dahua devices

As reported by The Hacker News, a cybersecurity campaign dubbed Operation CameraSwarm has compromised over 14,530 Dahua devices between June 17 and July 22, 2026. Researchers at Hunt.io detailed the operation, which utilized credential attacks, two authentication-bypass vulnerabilities, and a peer-to-peer (P2P) relay technique to gain unauthorized access.

The campaign, primarily impacting devices in Ukraine and Russia, leveraged CVE-2021-33044 and CVE-2021-33045, two authentication-bypass flaws rated 9.8 CVSS by the NVD. These vulnerabilities allowed attackers to bypass device identity authentication by sending malicious data packets. Additionally, a P2P relay technique, separate from the CVEs, enabled access to devices behind network address translation (NAT) by using a valid serial number to establish a relay path before device credential checks.

Hunt.io reported that 12,324 devices were compromised via credential attacks, 1,923 through authentication bypass, and 283 via the P2P relay. While Dahua has released firmware fixes for the CVEs, ITRES Labs recommends disabling P2P functionality where not essential and ensuring devices are running the latest firmware. The campaign's operator is believed to be Russian-speaking, though no specific threat actor has been identified.

Source: The Hacker News