p2pwn Backdoor Account Creation via CVE-2024-39943 Exploitation

Arnold Chan@slaz

•updated Sep 6, 2026•0•0•3

This rule monitors for the creation or presence of a specific backdoor account (username 'p2pwn' and password 'p2password') on Dahua devices. This account is known to be injected by threat actors exploiting CVE-2024-39943 as part of Operation CameraSwarm to maintain persistent unauthorized access.