Operation CameraSwarm: 14,500+ Dahua Devices Compromised via Credential Attacks, Auth Bypasses, and P2P Relay — Detection and Hardening Guide

Between June 17 and July 22, 2026, threat actors compromised more than 14,530 Dahua devices — IP cameras, NVRs, and related video-surveillance infrastructure — in a campaign researchers at Hunt.io have codenamed Operation CameraSwarm. The campaign was reconstructed from a 407 MB exposed working directory containing 2,616 files left accessible by the operators, giving defenders an unusually detailed view into the tooling and methodology.

This is not a theoretical exposure story. Five weeks, 14,500+ devices, and three distinct attack vectors — credential attacks, two authentication-bypass flaws, and abuse of Dahua's peer-to-peer (P2P) relay architecture — demonstrate a repeatable, scalable pipeline for IoT surveillance device takeover. If your organization runs Dahua hardware (or rebranded OEM variants of it, which is a significant portion of the commercial CCTV market), assume you are in scope.

Why this matters operationally: compromised cameras and NVRs are not just a privacy and physical-security problem. They are footholds. IoT botnets of this scale are routinely monetized as DDoS capacity, proxy infrastructure for subsequent intrusions, and lateral-movement staging points into corporate networks — especially where surveillance VLANs are flat with operational or corporate segments.

Technical Analysis

Affected Products

The campaign targets Dahua-manufactured devices broadly, which includes:

• Dahua-branded IP cameras and network video recorders (NVRs)
• OEM/white-label devices built on Dahua firmware sold under dozens of third-party brand names

This last point trips up a lot of asset inventories. If your camera fleet was procured under a non-Dahua brand, you cannot assume you are unaffected — validate firmware lineage with your integrator. Hunt.io's findings indicate the actors were targeting the Dahua software stack (web management interface, proprietary management protocol, and P2P subsystem) rather than a single SKU, so any device running vulnerable firmware builds is in scope.

Attack Chain

The reconstructed operator working directory shows a three-pronged exploitation pipeline:

1. Credential attacks. Automated credential stuffing and default/weak-password brute forcing against exposed web management interfaces (TCP 80/443) and the proprietary Dahua management protocol (commonly TCP 37777, and vendor-specific ports such as 9000). Dahua devices ship with notoriously weak credential hygiene in the field — unchanged defaults, shared credentials across fleets, and credentials reused from prior breaches. At 14,500+ devices in five weeks, credential attacks were almost certainly the highest-volume vector.

2. Two authentication-bypass flaws. The operators weaponized two distinct auth-bypass vulnerabilities against the device's management stack. (The disclosure summary does not assign public CVE identifiers; treat the specific flaws as unpatched-in-the-wild until you confirm against the current Dahua security advisory feed for your firmware branch.) Authentication bypasses against embedded web stacks typically manifest as direct requests to authenticated-only endpoints — config export, password retrieval, or account-creation endpoints — succeeding without a valid session. From a defender's perspective, the observable is the same regardless of the specific flaw: unauthenticated requests reaching sensitive administrative endpoints, often followed immediately by configuration changes or credential exfiltration.

3. P2P relay abuse. Dahua devices ship with a cloud P2P feature enabled by default, allowing remote viewing through vendor-operated relay infrastructure using the device serial number. This architecture defeats the most common mitigation — removing the device from direct internet exposure. Attackers with valid serial numbers (harvested from scanning, defaults, or prior compromise) can reach devices behind NAT and firewalls through the P2P cloud, and the campaign leveraged this as a relay technique to access devices that were not directly internet-facing. This is the vector most likely to surprise network defenders: egress-filtered, non-internet-routable cameras are still reachable.

Exploitation Status

• Confirmed mass exploitation in the wild. 14,530+ confirmed compromises over a five-week window.
• Active operator tooling recovered. The exposed 407 MB working directory (2,616 files) constitutes effectively leaked exploitation tooling — expect copycat adoption by botnet operators.
• Scale and automation indicate botnet-style operations, consistent with device enrollment into proxy/DDoS infrastructure.

No public CVE identifiers were named in the disclosure summary; do not assume absence of CVEs means absence of patchable flaws — check Dahua's security advisory portal against your firmware versions and treat unpatched management interfaces as actively exploitable.

Detection & Response

Sigma Rules

---
title: Suspicious Requests to Dahua Camera Administrative Endpoints
id: 3f8c2e1a-7b4d-4f9e-a6c2-1d5e9b7a3f01
status: experimental
description: Detects HTTP requests targeting Dahua device administrative and authentication-sensitive endpoints, consistent with credential attacks and authentication-bypass exploitation observed in Operation CameraSwarm.
references:
  - https://thehackernews.com/2026/08/hackers-compromised-14500-dahua-devices.html
  - https://attack.mitre.org/techniques/T1110/
author: Security Arsenal
date: 2026/08/10
tags:
  - attack.initial_access
  - attack.t1190
  - attack.t1110
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri|contains:
      - '/RPC2_Login'
      - '/current_config'
      - '/cgi-bin/configManager.cgi'
      - '/cgi-bin/userManager.cgi'
      - '/cgi-bin/magicBox.cgi'
      - '/configManager?action=getConfig'
      - '/cgi-bin/global.cgi'
  selection_unauthenticated:
    sc-status:
      - 200
    c-referer: ''
  condition: selection_uri and selection_unauthenticated
falsepositives:
  - Legitimate camera management via VMS integrations hitting the same endpoints
  - Internal vulnerability scanners validating camera posture
level: high
---
title: High-Volume Authentication Failures Against Embedded Devices
id: 9a1d4c6b-2e8f-4a3c-b7d5-6f1a8c3e9d24
status: experimental
description: Detects syslog patterns consistent with brute-force or credential-stuffing attacks against Dahua web and management interfaces, a primary vector in Operation CameraSwarm.
references:
  - https://thehackernews.com/2026/08/hackers-compromised-14500-dahua-devices.html
  - https://attack.mitre.org/techniques/T1110/
author: Security Arsenal
date: 2026/08/10
tags:
  - attack.credential_access
  - attack.t1110
logsource:
  product: linux
  service: auth
detection:
  selection:
    - 'login failed'
    - 'authentication failed'
    - 'invalid user'
    - 'password error'
  condition: selection
falsepositives:
  - Legitimate forgotten-password attempts by administrators (low volume)
  - Misconfigured VMS systems retrying stale credentials
level: medium
---
title: Internal Host Enumerating Camera Management Ports
id: 5e7b3f92-1c6a-4d8e-a2f4-8b9c3d1e6a57
status: experimental
description: Detects internal hosts initiating connections to Dahua proprietary management ports across multiple destinations, indicating camera fleet enumeration or lateral movement from a compromised internal host toward surveillance infrastructure.
references:
  - https://thehackernews.com/2026/08/hackers-compromised-14500-dahua-devices.html
  - https://attack.mitre.org/techniques/T1046/
author: Security Arsenal
date: 2026/08/10
tags:
  - attack.discovery
  - attack.t1046
logsource:
  category: network_connection
  product: windows
detection:
  selection_port:
    DestinationPort:
      - 37777
      - 37778
      - 9000
      - 554
  filter_management:
    Image|endswith:
      - '\milestone.exe'
      - '\genetec.exe'
  condition: selection_port and not filter_management
falsepositives:
  - Legitimate VMS and camera management platforms (tune the filter list to your environment's VMS stack)
  - Asset inventory / network management scanning
level: medium

KQL — Microsoft Sentinel / Defender

Camera and NVR telemetry typically reaches Sentinel via syslog/CEF ingestion from firewalls, or via a syslog collector on the camera VLAN. This query hunts the two dominant observables: authentication-failure bursts against Dahua management ports and outbound connections to P2P relay infrastructure from devices that shouldn't be talking to the internet at all.

// Operation CameraSwarm hunt: credential attacks + P2P relay egress on Dahua infrastructure
let CameraPorts = dynamic([80, 443, 554, 37777, 37778, 9000]);
let P2PTimeWindow = 7d;
union isfuzzy=true
(CommonSecurityLog
 | where TimeGenerated > ago(P2PTimeWindow)
 | where DestinationPort in (CameraPorts)
 | where DeviceAction in ("allow", "permit") and DeviceAction != "deny"
 | summarize ConnectionCount = count(), DistinctSources = dcount(SourceIP)
     by DestinationIP, DestinationPort, bin(TimeGenerated, 1h)
 | where DistinctSources > 10  // many sources hitting one camera = stuffing/scan target
 | extend Signal = "Inbound credential-attack pattern"),
(Syslog
 | where TimeGenerated > ago(P2PTimeWindow)
 | where SyslogMessage has_any ("login failed", "authentication failed", "invalid user")
 | summarize FailureCount = count(), Sources = make_set(SourceIP, 20)
     by HostIP, bin(TimeGenerated, 15m)
 | where FailureCount > 50
 | extend Signal = "Brute-force burst against device"),
(DeviceNetworkEvents
 | where TimeGenerated > ago(P2PTimeWindow)
 | where RemotePort in (CameraPorts)
 | where LocalIPType == "Private" and RemoteIPType == "Private"
 | summarize DistinctCameraTargets = dcount(RemoteIP), Ports = make_set(RemotePort)
     by DeviceName, LocalIP, InitiatingProcessFileName, bin(TimeGenerated, 1h)
 | where DistinctCameraTargets > 20  // internal host enumerating camera fleet
 | extend Signal = "Internal camera enumeration")
| project TimeGenerated, Signal, DestinationIP, HostIP, DeviceName, LocalIP,
          InitiatingProcessFileName, ConnectionCount, FailureCount, DistinctCameraTargets, Sources
| order by TimeGenerated desc

A second, simpler query worth running weekly: flag any camera-VLAN host making outbound internet connections at all. Surveillance devices have near-zero legitimate reasons to initiate arbitrary internet egress — with the deliberate exception of Dahua P2P cloud endpoints, which is exactly the channel this campaign abused. Baseline your P2P relay destinations, then alert on everything else.

// Baseline-check: unexpected internet egress from surveillance subnet
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where SourceIP startswith "10.50.30."   // <- replace with your camera VLAN CIDR
| where not (DestinationIP startswith "10.") and not (DestinationIP startswith "192.168.") and not (DestinationIP startswith "172.16.")
| summarize EgressConnections = count(), Destinations = make_set(DestinationIP, 30), Ports = make_set(DestinationPort)
  by SourceIP
| order by EgressConnections desc

Velociraptor VQL

Use this artifact against endpoints and management workstations to identify processes talking to Dahua management ports — useful for catching a compromised admin workstation or an implant pivoting toward the surveillance fleet.

-- Hunt: processes with active connections to Dahua management ports
-- Operation CameraSwarm - lateral movement / enumeration detection
LET conns = SELECT Pid, Name, Path, Status,
       "Laddr" as LocalAddr, Lport, Raddr as RemoteAddr, Rport as RemotePort
FROM netstat()
WHERE RemotePort in (37777, 37778, 9000, 554, 80)
  AND Status =~ 'ESTABLISHED|SYN'

SELECT c.Pid, c.Name, c.Path, c.RemoteAddr, c.RemotePort, c.Status,
       p.CommandLine, p.Username, p.CreateTime
FROM conns AS c
JOIN (SELECT Pid, CommandLine, Username, CreateTime FROM pslist()) AS p
ON c.Pid = p.Pid
WHERE NOT p.CommandLine =~ 'milestone|genetec|exacq|networkoptix'  -- tune: your VMS processes
ORDER BY c.RemoteAddr

A companion artifact for auditing endpoints for downloaded camera exploitation or scanner tooling dropped by operators:

-- Hunt: scanner/IoT tooling staged on endpoints
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs='C:\Users\*\**\*.exe')
WHERE FullPath =~ '(?i)(dahua|camera|ipc_scan|ipscan|masscan|zmap|hikvision_scan)'
ORDER BY Mtime DESC

Remediation & Hardening Script

The following Bash script performs discovery of Dahua devices on a target subnet, inventories firmware where reachable, and flags devices with P2P enabled or default-credential risk. Run it from a management host with network reach to the camera VLAN. It does not exploit anything — it uses nmap service detection and the vendor's own discovery responses.

#!/bin/bash
# Operation CameraSwarm - Dahua fleet discovery and exposure audit
# Run from a management host with reach to the camera VLAN.
set -euo pipefail

SUBNET="${1:?Usage: $0 <camera-vlan-cidr> e.g. $0 10.50.30.0/24}"
OUT="dahua_audit_$(date +%Y%m%d_%H%M%S)"
mkdir -p "$OUT"

echo "[*] Phase 1: Discovering devices with Dahua management ports open"
nmap -sS -Pn -p 80,443,554,37777,37778,9000 --open -oG "$OUT/open_ports.gnmap" "$SUBNET"

echo "[*] Phase 2: Service fingerprinting on discovered hosts"
awk '/Ports:/{print $2}' "$OUT/open_ports.gnmap" | sort -u > "$OUT/targets.txt"
nmap -sV -Pn -p 80,443,37777,9000 -iL "$OUT/targets.txt" -oN "$OUT/fingerprint.txt"
grep -iE 'dahua|cctv|dvr|nvr' "$OUT/fingerprint.txt" | sort -u > "$OUT/confirmed_dahua.txt" || true

echo "[*] Phase 3: Audit each confirmed/likely Dahua host for exposure"
while read -r HOST; do
  [ -z "$HOST" ] && continue
  echo "=== $HOST ==="

  # Check if web interface responds and identify firmware hints via banner/title
  curl -sk --max-time 5 "http://$HOST/" | grep -ioE 'dahua|IPC|NVR[0-9]*|Web5?\.0' | sort -u || echo "no web banner"

  # Check for unauthenticated reachability of config endpoints (auth-bypass smoke test)
  for EP in /current_config/passwd /cgi-bin/magicBox.cgi?action=getSystemInfo; do
    CODE=$(curl -sk -o /dev/null -w '%{http_code}' --max-time 5 "http://$HOST$EP")
    if [ "$CODE" = "200" ]; then
      echo "  [ALERT] $HOST -> $EP returned HTTP 200 unauthenticated. POSSIBLE AUTH BYPASS."
      echo "$HOST $EP" >> "$OUT/auth_bypass_hits.txt"
    fi
  done
done < "$OUT/targets.txt"

echo "[*] Phase 4: Flag outbound P2P/egress risk (requires device CLI or firewall logs)"
echo "    Verify on-device: disable 'P2P / Easy4IP' in Network settings, or block UDP 8800-8899 and known Dahua P2P relay destinations at the VLAN egress firewall."

echo "[+] Audit complete. Results in ./$OUT/"

Remediation

Prioritize in this order — the campaign's own telemetry tells you where the leverage is:

1. Credential hygiene (highest-volume vector).

• Force a fleet-wide password reset on every Dahua and Dahua-OEM device. Eliminate default and shared credentials; use unique per-device credentials stored in your vault.
• Where the firmware supports it, enforce password complexity and account lockout policies. Where it doesn't, that's a compensating-control flag.
• Audit for accounts you didn't create — an exposed operator working directory means planted backdoor accounts are a realistic post-compromise artifact.

2. Remove direct internet exposure.

• No camera or NVR management interface should be internet-routable. Full stop. Scan your public IP space (Shodan/Censys against your own ASN and IP ranges) for TCP 37777/9000/80/443 responses matching Dahua fingerprints.
• Block inbound management access at the perimeter and restrict management plane access to a dedicated jump host or VMS subnet.

3. Disable P2P unless operationally required.

• P2P (Easy4IP and successors) punches through NAT and makes "internal-only" devices reachable from the cloud relay using just the serial number. Operation CameraSwarm weaponized exactly this.
• Disable the P2P feature in device network settings. If remote viewing is a business requirement, route it through your VPN or VMS gateway instead of the vendor relay.
• At the camera-VLAN egress firewall, block outbound traffic to Dahua P2P relay infrastructure (UDP 8800–8899 and known relay hostnames) and alert on attempted connections.

4. Patch and firmware management.

• The two authentication-bypass flaws used in this campaign were not assigned public CVE identifiers in the disclosure. Pull the current Dahua security advisory feed and firmware release notes for your exact models, and upgrade to the latest stable firmware branch. For OEM devices, push your reseller for the equivalent patch train — do not accept "no update available" without written confirmation of firmware lineage.
• If a device is end-of-life with no patch path, it must be isolated behind compensating controls (management ACLs, no egress, jump-host-only access) or replaced. EOL IoT on the network is pre-compromised IoT.

5. Segmentation.

• Cameras live in a dedicated VLAN with default-deny egress and no lateral reachability to corporate or OT segments. A compromised camera should be a camera problem, not a domain problem.

6. Compromise assessment for exposed devices.

• Any device that was internet-exposed during June 17 – July 22, 2026 (or that responds unauthenticated to the endpoints in the audit script) should be treated as compromised: factory reset, firmware reflash from vendor media, credential rotation, and review of configuration for unauthorized accounts, modified settings, or unfamiliar scheduled tasks.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub