cyber.hendryadrian.com
Threat Research · securityweek.com

Hunt.io Details Operation CameraSwarm and 14,530 Compromised Dahua Cameras

· Original article ↗

Summary

Hunt.io reports that Operation CameraSwarm compromised 14,530 Dahua cameras in Ukraine and Russia, using brute force and authentication bypasses to deploy a persistent backdoor. The report does not establish the operator’s motivation.

Key points

  • Hunt.io says the 35-day campaign ran from June 17 to July 22 and compromised more than 14,530 devices across Ukraine and Russia.
  • The actor used a brute-force engine against 12,324 unique addresses and deployed a persistent backdoor account on 1,923 cameras via RPC.
  • The account used the p2pwn/p2password credentials and, according to Hunt.io, survives password changes and most firmware factory resets.
  • A compiled Go binary chained authentication-bypass vulnerabilities CVE-2021-33044, CVE-2021-33045, and CVE-20244-39943 to deploy the account.
  • In some cases, the actor used Dahua’s cloud relay and camera serial numbers to reach devices behind NATs.
  • Hunt.io assesses with moderate confidence that the toolkit was designed to transfer access to a third party; it says the evidence does not confirm a commercial operation.
  • The report does not establish the operator’s ultimate motivation or intended use of the compromised cameras.

Article Details

Attack Vectors
  • Scanning across ISP ranges, initially in Russia, Mexico, and Vietnam, later focusing on Russian and CIS telecom netblocks.
  • Credential brute-forcing against Dahua IP cameras.
  • Authentication bypass using CVE-2021-33044 and CVE-2021-33045, with a compiled Go binary reportedly chaining three vulnerabilities.
  • Deployment of a persistent backdoor account over RPC.
  • Abuse of Dahua's cloud relay to reach cameras behind NAT using their serial numbers.
Defensive Notes
  • The p2pwn/p2password account is stored independently of the admin password and reportedly survives password changes and, on most firmware, a factory reset.

MITRE ATT&CK

T1110.001 · Password GuessingA brute-force engine was used to target 12,324 unique addresses.T1136.001 · Local AccountThe actor deployed a persistent backdoor account on cameras over RPC.T1190 · Exploit Public-Facing ApplicationA compiled Go binary reportedly chained authentication-bypass vulnerabilities to access Dahua cameras.T1595.001 · Scanning IP BlocksThe actor scanned ISP address ranges, initially across multiple countries and later focusing on Russian and CIS telecom netblocks.

CVE

CVE-2021-33044Additionally, they relied on a compiled Go binary for authentication bypass, chaining three vulnerabilities, including the CVE-2021-33044 and CVE-2021-33045 bypasses, and CVE-20244-39943 to deploy the backdoor account.CVE-2021-33045Additionally, they relied on a compiled Go binary for authentication bypass, chaining three vulnerabilities, including the CVE-2021-33044 and CVE-2021-33045 bypasses, and CVE-20244-39943 to deploy the backdoor account.

Vendors

DahuaA threat actor has conducted a mass-hacking campaign against Dahua IP cameras, compromising over 14,000 of them across Ukraine and Russia, Hunt.io reports.

Products

Dahua IP camerasA threat actor has conducted a mass-hacking campaign against Dahua IP cameras, compromising over 14,000 of them across Ukraine and Russia, Hunt.io reports.

Countries

RussiaA threat actor has conducted a mass-hacking campaign against Dahua IP cameras, compromising over 14,000 of them across Ukraine and Russia, Hunt.io reports.UkraineA threat actor has conducted a mass-hacking campaign against Dahua IP cameras, compromising over 14,000 of them across Ukraine and Russia, Hunt.io reports.

Related Articles