Operation CameraSwarm: 14,000+ Dahua Cameras Compromised via P2P and Exploits

Between June and July 2026, a widespread exploitation campaign known as Operation CameraSwarm compromised over 14,000 Dahua IP cameras, primarily in Ukraine and Russia. The operation relied on three distinct paths: large-scale credential brute-forcing, an authentication-bypass chain exploiting two 2021 vulnerabilities, and a sophisticated abuse of Dahua’s legitimate P2P relay infrastructure. Analysis of an exposed server directory revealed a toolkit assembled from multiple upstream researchers, including the 'p2pwn' binary and a Windows-based credential stealer identified as SalatStealer.

The technical significance of this campaign lies in the operator's ability to reach devices behind NAT by harvesting and brute-forcing serial numbers to establish P2P tunnels. Over 1,900 cameras were found with a persistent backdoor account ('p2pwn') that survives password changes and factory resets on many firmware versions. Furthermore, the operator utilized offline recovery-code generation, granting administrative access independently of existing credentials. This allows for long-term persistence and the potential transfer of access to third parties.

This activity highlights a critical failure in IoT security posture, where predictable serial numbers and unpatched legacy vulnerabilities (CVE-2021-33044 and CVE-2021-33045) facilitate mass compromise. Organizations with Dahua deployments must prioritize disabling P2P functionality, rotating all credentials, and performing manual firmware updates, as automated update mechanisms in some models have been reported as unreliable.