KYIV / THE HAGUE — In an escalating cyber-espionage conflict running parallel to kinetic warfare, cybersecurity authorities in Ukraine have issued an urgent warning regarding widespread, unauthorized remote access to video surveillance systems manufactured by Dahua Technology.

The Computer Emergency Response Team of Ukraine (CERT-UA), operating under the auspices of the State Special Communications Service of Ukraine (SSSCIP), revealed that malicious actors are successfully compromising IP cameras and Digital Video Recorders (DVRs). Attackers are actively seizing control of live video streams, modifying device configurations, and establishing persistent, unauthorized third-party administrative accounts that evade basic remediation efforts.

The campaign highlights a dangerous convergence of automated internet scanning, predictable hardware architecture, and unpatched legacy vulnerabilities. Crucially, intelligence assessments from Western and Ukrainian agencies link these camera intrusions directly to Russian state-sponsored espionage operations aimed at tracking military logistics, weapon supplies, and personnel movements across Europe and Ukraine.

The Main Facts: Anatomy of the Vulnerability

The primary initial access vector fueling these attacks relies on Easy4IP, a peer-to-peer (P2P) platform developed by Dahua. Easy4IP allows consumers and small-business owners to remotely monitor their properties by connecting Dahua IP cameras, Network Video Recorders (NVRs), and DVRs to a smartphone application or web browser. Connection is typically established simply by scanning a physical QR code or manually inputting a hardware Serial Number (SN).

However, security researchers and CERT-UA have highlighted a fundamental architectural flaw: Dahua device serial numbers follow a predictable structure.

A typical serial number consists of a 10-character model prefix—which is identical for all units belonging to the same device family—followed by a five-character hexadecimal counter that increments almost sequentially (e.g., 7K01F36PCA003E8).

Because of this predictable sequencing, malicious actors can execute large-scale, automated brute-force attacks to guess valid serial numbers. Threat actors can systematically query the manufacturer’s cloud infrastructure to identify active, cloud-connected devices without triggering rate limits or account lockouts.

Consequently, any device with active P2P functionality is exposed to remote compromise, even if the device sits safely behind a Network Address Translation (NAT) firewall and cannot be accessed directly via the public internet.

"The assumption that the serial number is unknown to anyone is not a reason to consider the device secure," CERT-UA warned in its advisory.

Once threat actors identify active serial numbers via cloud relays, they bypass authentication barriers by exploiting weak or default administrator passwords, or by leveraging known, high-severity authentication bypass vulnerabilities in outdated firmware versions—most notably CVE-2021-33044 and CVE-2021-33045.

Chronology of Campaigns: From Broad Scanning to "Operation CameraSwarm"

While CERT-UA did not initially disclose the full scope or exact timeline of the latest infections, independent telemetry and threat intelligence reports from organizations like Hunt.io paint a chilling picture of coordinated, multi-phased operations targeting IP cameras across Eastern Europe and Ukraine.

Phase 1: The Russian-Speaking Operator Toolkit

Earlier in the deployment cycle, threat intelligence analysts tracked a campaign orchestrated by a Russian-speaking operator. This cluster explicitly singled out internet-exposed cameras in Ukraine by utilizing the publicly available webcam vulnerability scanner known as Ingram.

By integrating Ingram, the operator scanned and exploited known Dahua and Hikvision flaws to compromise at least 58 localized devices. Simultaneously, the same threat actor expanded its operational footprint, scanning and exploiting TP-Link and MikroTik routers and cameras across 15 European countries—including Ukraine, Poland, Romania, Moldova, Hungary, Czechia, Slovakia, Bulgaria, Germany, France, the Netherlands, Italy, Spain, the United Kingdom, and Austria—leveraging critical vulnerabilities such as CVE-2024-53375 and CVE-2024-57049.

Phase 2: Operation CameraSwarm (June – July 2026)

A more aggressive and structurally sophisticated operation, codenamed Operation CameraSwarm, was later uncovered by threat hunters. Attributed to a dedicated, lone threat actor, this campaign systematically compromised over 14,530 Dahua IP cameras between June 17 and July 22, 2026.

The attack methodology during Operation CameraSwarm typically followed a strict protocol:

1. Port Scanning: Scanners probed for TCP port 37777, the default proprietary management and video streaming port utilized by Dahua devices.
2. Serial Number Harvesting: Attackers cataloged valid hardware serial numbers.
3. Exploitation: The actor forced entry using credential brute-force methods or the CVE-2021-33044/CVE-2021-33045 authentication bypass chain.
4. Backdoor Deployment: On nearly 2,000 compromised units, the attackers installed a persistent backdoor account named p2pwn (with the password p2password) via Remote Procedure Calls (RPC).

Most alarmingly, Hunt.io noted that this backdoor is stored independently of the primary administrator password. As a result, it successfully survives standard password changes and, on a vast majority of vulnerable firmware versions, even survives a complete factory reset.

Furthermore, Hunt.io reported that 283 cameras were successfully breached exclusively via their serial numbers through Dahua’s cloud relay, requiring no direct device IP address and, in many cases, no valid credentials whatsoever.

Supporting Data and Technical Indicators

The ongoing exploitation campaigns rely on a combination of legacy software flaws and structural design choices in consumer-grade and enterprise-grade Internet of Things (IoT) hardware.

Key Vulnerabilities Exploited:

• CVE-2021-33044: An authentication bypass vulnerability in Dahua IP cameras/NVRs allowing remote attackers to escalate privileges and access management interfaces.
• CVE-2021-33045: A stack-based buffer overflow and improper authentication flaw allowing remote code execution or administrative bypass.
• CVE-2024-53375 & CVE-2024-57049: Router and camera firmware flaws exploited to pivot deeper into local network perimeters across European states.

Indicators of Compromise (IoCs):

• Default Ports: Heavy inbound and outbound traffic targeting TCP port 37777.
• Unauthorized Accounts: The sudden presence of user accounts labeled p2pwn, p2password, or unfamiliar administrative profiles created outside standard organizational maintenance windows.
• Cloud Abuse: Abnormal volume of outbound connections querying Dahua’s Easy4IP/P2P relay infrastructure from cameras that previously operated entirely within local closed-circuit networks.

Official Responses and Remediation Guidance

In response to the escalating threat landscape, government agencies and cybersecurity bodies have outlined strict defensive postures for system administrators and private citizens alike.

CERT-UA and the SSSCIP have urged all organizations and individuals utilizing Dahua surveillance systems to implement the following mitigation steps immediately:

1. Disable P2P Functionality: If remote viewing via mobile apps using P2P QR codes is not an absolute business requirement, disable the P2P/Easy4IP feature entirely within the device settings.
2. Isolate from the Public Internet: Never expose IP cameras, NVRs, or DVRs directly to the public internet via port forwarding on routers. Instead, mandate the use of a secure, encrypted Virtual Private Network (VPN) for remote administrative access.
3. Apply Firmware Updates: Immediately patch all devices to the latest vendor-supplied firmware versions to eradicate known exploitation vectors like CVE-2021-33044 and CVE-2021-33045.
4. Audit User Accounts: Regularly review user lists on all surveillance hardware to detect and remove unauthorized accounts, specifically looking for residual backdoors like p2pwn.
5. Enforce Strong Authentication: Eliminate default, weak, or factory-set passwords across all administrative and viewing accounts.

Strategic Implications: Digital Espionage on the Battlefield

The implications of these camera hacks extend far beyond standard cybercrime or ransomware extortion. Intelligence assessments released earlier this year by Dutch intelligence agencies—including the General Intelligence and Security Service (AIVD)—explicitly warn that Russian state actors are systematically compromising IP cameras throughout the European Union, NATO member states, and Ukraine to conduct digital espionage operations and gather actionable military intelligence.

According to a comprehensive advisory published by Western intelligence, Russian operators are leveraging automated image-recognition software to scan real-time video feeds for specific military assets:

• Logistics Tracking: Identifying military vehicles, convoys, and heavy equipment during transit.
• Supply Line Mapping: Pinpointing weapon deliveries and international military assistance moving toward Ukraine.
• Personnel Localization: Tracking the real-time locations and movements of Ukrainian military personnel.

The intelligence report delivered a sobering conclusion: data siphoned from compromised IP cameras in and around Ukraine is actively being synthesized to coordinate targeting packages aimed at neutralizing Ukrainian military personnel and destroying vital defense materiel.

As the physical war continues on the ground, the exploitation of insecure IoT devices demonstrates that civilian infrastructure—from small-business security cameras to residential smart devices—has become an active, highly contested digital frontline in modern geopolitical conflict.