Operation CameraSwarm: Mass Exploitation of Dahua IoT Devices

Operation CameraSwarm involved the compromise of approximately 14,530 Dahua devices between June and July 2026. The operation was conducted by a Russian-speaking operator who leveraged a multi-stage attack chain involving internet-wide scanning, credential brute-forcing, and the exploitation of known vulnerabilities. The campaign was discovered through an exposed open directory on the operator's infrastructure, which revealed a sophisticated toolkit composed of various upstream research tools.

The attack leveraged two critical 2021 authentication bypass vulnerabilities (CVE-2021-33044 and CVE-2021-33045) and a novel P2P relay abuse technique that allows attackers to reach devices behind NAT using only serial numbers. A significant finding is that 89.4% of targeted devices via the P2P path required no authentication at all. Additionally, the operator staged a Windows-based credential stealer, identified as SalatStealer, alongside the IoT exploitation tools, indicating potential intent to pivot into enterprise environments.

This campaign poses a significant risk to the physical security and data privacy of affected sectors, particularly government and critical infrastructure in the CIS region. The use of persistent backdoors that survive factory resets on some firmware versions necessitates immediate remediation, including firmware updates and manual account audits.