CameraSwarm Campaign Compromised 14,530 Dahua Cameras, Researchers Report
Summary
Hunt.io says the 35-day CameraSwarm campaign compromised 14,530 Dahua cameras using brute force, two vulnerabilities, and recovery codes. Attackers installed persistent p2pwn accounts; owners are advised to check devices and update firmware.
Key points
- Hunt.io researchers report that CameraSwarm compromised 14,530 Dahua IP cameras between June 17 and July 22, mainly in Ukraine and Russia.
- The campaign used brute-force scanning of TCP port 37777, exploits for CVE-2021-33044 and CVE-2021-33045, and cloud-relay access using camera serial numbers and SDK credentials.
- The p2pwn tool installed a persistent account on 1,923 cameras; the account survives password changes and, on most firmware versions, factory resets.
- The toolkit could generate password-recovery codes from camera serial numbers. Hunt.io warns that removing p2pwn does not invalidate codes already generated.
- Researchers traced the operation to an exposed attacker working directory containing code, logs, credentials, camera images, and exploitation results.
- Hunt.io advises checking for and removing p2pwn, disabling P2P when unnecessary, and installing Dahua SA-2021-0130 firmware updates or later versions.
Article Details
- Attack Vectors
- Brute-force login attempts against Dahua IP cameras, including scanning TCP port 37777.
- Exploitation of CVE-2021-33044 and CVE-2021-33045 using the p2pwn tool to install a persistent backdoor account.
- Use of camera serial numbers and SDK credentials embedded in Dahua applications to redeem offline recovery codes and reach cameras behind NAT.
- Defensive Notes
- Treat Dahua cameras reachable through port 37777 during June and July as potentially compromised.
- Check for and remove the p2pwn account; the article warns that removing it does not invalidate recovery codes generated by the toolkit.
- Disable P2P when it is not needed.
- Apply Dahua SA-2021-0130 firmware updates for CVE-2021-33044 and CVE-2021-33045, or install a later firmware version.
MITRE ATT&CK
T1078 · Valid AccountsThe operator used SDK credentials and recovery codes redeemed through Dahua’s password-recovery process to access cameras.T1110.001 · Password GuessingThe campaign used a brute-forcing system to try logins against Dahua cameras.T1136.001 · Local AccountThe p2pwn tool installed a persistent backdoor account on compromised cameras.T1190 · Exploit Public-Facing ApplicationThe campaign exploited CVE-2021-33044 and CVE-2021-33045 on Dahua cameras.T1595.001 · Scanning IP BlocksThe operator scanned TCP port 37777, first checking Russian address space and then the full IPv4 range.
CVE
Vendors
Products
Dahua IP camerasResearchers uncovered CameraSwarm, a 35-day campaign that compromised more than 14,500 Dahua IP cameras, mainly in Ukraine and Russia, using brute-force logins, vulnerability exploits, and offline recovery codes.SMART PSSIt captured usable camera snapshots, sent results to Telegram, and exported them for Dahua’s SMART PSS platform.
Tools
Countries
RussiaResearchers uncovered CameraSwarm, a 35-day campaign that compromised more than 14,500 Dahua IP cameras, mainly in Ukraine and Russia, using brute-force logins, vulnerability exploits, and offline recovery codes.UkraineResearchers uncovered CameraSwarm, a 35-day campaign that compromised more than 14,500 Dahua IP cameras, mainly in Ukraine and Russia, using brute-force logins, vulnerability exploits, and offline recovery codes.