Over 14,500 Dahua Security Cameras Hacked via Three Simultaneous Attack Methods

A campaign dubbed Operation CameraSwarm has compromised more than 14,530 Dahua IP cameras across Ukraine and Russia, according to a report published by Hunt.io on August 18, 2026. Attackers exploited three parallel methods: password spraying over TCP port 37777, two known authentication bypass vulnerabilities (CVE-2021-33044 and CVE-2021-33045), and unauthenticated access through Dahua's official cloud relay infrastructure using serial numbers alone. The operation enabled theft of camera footage, device credentials, and NVR connection passwords, while a persistent backdoor account called p2pwn allowed re-entry even after password changes or factory resets on some models. Because video feeds remain active for end users, many victims are unlikely to detect the intrusion. Administrators are advised to patch firmware, restrict TCP/37777 exposure, disable unnecessary P2P functions, and monitor for suspicious account creation activity.