Threat reportVulnerabilityTL-2026-4457
CERT-UA warns of active exploitation of Dahua cameras and recorders via Easy4IP and CVE-2021-33044/CVE-2021-33045 (Operation CameraSwarm)
CERT-UA warns of active exploitation of Dahua cameras and (TL-2026-4457), also tracked as Operation CameraSwarm, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-10-26. It has no confirmed attribution, affects Dahua IP cameras IPC-HX3XXX, IPC-HX5XXX, IPC-HUM7XXX, references 3 CVEs (CVE-2021-33044, CVE-2021-33045, CVE-2025-31702), maps to 11 MITRE ATT&CK techniques (T1027.002, T1078.001, T1090), and is covered by 9 detection rules and 26 indicators of compromise.
- CVSS
- 9.8/10Critical
- CVEs
- 3Referenced vulnerabilities
- Techniques
- 11MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 26Indicators of compromise
Key facts for TL-2026-4457
- Threat ID
- TL-2026-4457
- Also known as
- Operation CameraSwarm
- Severity
- CRITICAL
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- government administration, residential, critical-infrastructure, municipal-surveillance
- Target regions
- ukraine, russia
- Detection rules
- 9
- Indicators of compromise
- 26
Malware and tooling in CERT-UA warns of active exploitation of Dahua cameras and
Malware and tooling: SalatStealer, asleep_scanner, dh-p2p, p2pwn
How CERT-UA warns of active exploitation of Dahua cameras and works
Ukraine's CERT-UA warned that Chinese-made Dahua cameras and video recorders are being hacked by guessing serial numbers through the Easy4IP cloud feature, brute-forcing weak passwords and exploiting two 2021 authentication-bypass flaws on outdated firmware. Hunt.io's Operation CameraSwarm report documented 14,530+ Dahua devices compromised between 17 June and 22 July 2026, concentrated in Ukraine and Russia.
On or about the week before 26 October 2026, CERT-UA published an advisory warning that attackers are compromising internet-connected Dahua surveillance cameras and network video recorders. Reported attacker actions include gaining access to video feeds, remote device control, changing device settings and creating unauthorized user accounts. Access is obtained by guessing large numbers of predictable device serial numbers to identify cameras attached to Dahua's Easy4IP cloud service (which lets users reach devices remotely, including behind firewalls), by weak or default passwords, and by exploiting vulnerabilities in outdated firmware. CVE-2021-33044 and CVE-2021-33045 are named. Ukrainian authorities have previously reported camera hijacking: the SBU identified hacked cameras in two Kyiv residential buildings in January 2024 whose footage was redirected to YouTube.
The technical background comes from Hunt.io's Operation CameraSwarm report (published 18 August 2026). Hunt.io's AttackCapture crawler flagged activity on TCP/37777 (Dahua's binary management protocol) and on 23 July 2026 found the operator's staging server exposing an open HTTP directory containing 2,616 files (407 MB) of tooling, logs, shell history and campaign records. Between 17 June and 22 July 2026 a single, apparently Russian-speaking operator compromised 14,530+ unique devices through three parallel paths: (1) an asyncio credential brute-force engine against TCP/37777 (12,324 unique IPs, 13,229 campaign records; default wordlist entries such as admin:admin, 666666:666666, 888888:888888, admin:admin123, default:tluafed), with successful devices sent as snapshots to a Telegram bot and exported as SMART PSS-compatible XML; (2) the 'p2pwn' Go tool chaining CVE-2021-33044 (login with clientType set to NetKeyboard bypasses password validation) and CVE-2021-33045 (firmware trusts a claimed 127.0.0.1 source address in the request body rather than the TCP connection) to bypass authentication and install a persistent backdoor account p2pwn / p2password on 1,923 cameras, which Hunt.io reports survives password changes and, on most firmware, factory resets; and (3) abuse of the Easy4IP/P2P cloud relay (easy4ipcloud.com:8800, PTCP tunnel protocol) to reach 283 cameras, including devices behind NAT, using only the serial number plus SDK credentials; the operator claimed 89.4% of live serials exposed access without authentication (operator claim, unverified). An offline recovery-code generator derives administrative recovery codes from the serial number alone.
Operator tooling also included serial brute-forcers targeting 13 serial prefixes (1,048,576 candidates each), Shodan harvesting of dahuaddns.com / quickddns.com devices, masscan sweeps of TCP/37777 (Russian CIDR list at 10M pps), a Windows UPX-packed SalatStealer binary (xeno.exe / 1.exe) and a PowerShell script adding Microsoft Defender exclusions. Confirmed geolocated compromises were concentrated in Ukraine and Russia, with Ukraine the larger share; DH-IPC-K35P was the most frequently compromised model. Both CVEs are CVSS 9.8, affect firmware built before June 2021 on listed IP cameras, video intercoms, PTZ domes and thermal cameras, and are in the CISA KEV catalog (added 21 August 2024). No named threat actor is attributed; language artifacts indicate Russian-speaking operators.
MITRE ATT&CK techniques used in TL-2026-4457
Defense Evasion
Initial Access
T1078.001 Default Accounts; T1190 Exploit Public-Facing Application
Command and Control
Credential Access
Collection
Persistence
Exfiltration
T1567.004 Exfiltration Over Webhook
Reconnaissance
T1595.001 Scanning IP Blocks; T1596.005 Scan Databases
defense-impairment
Affected products and versions in CERT-UA warns of active exploitation of Dahua cameras and
- Dahua — IP cameras IPC-HX3XXX, IPC-HX5XXX, IPC-HUM7XXX
Vulnerable versions: firmware built before June 2021
Fixed in: Firmware per Dahua security advisory (SA-2021-0130) - Dahua — Video intercoms VTO75X95X, VTO65XXX, VTH542XH
Vulnerable versions: firmware built before June 2021
Fixed in: Firmware per Dahua security advisory (SA-2021-0130) - Dahua — PTZ dome cameras SD1A1, SD22, SD49, SD50, SD52C, SD6AL
Vulnerable versions: firmware built before June 2021
Fixed in: Firmware per Dahua security advisory (SA-2021-0130) - Dahua — Thermal cameras TPC-BF1241, TPC-BF2221, TPC-BF5XXX, TPC-SD2221, TPC-SD8X21, TPC-PT8X21B
Vulnerable versions: firmware built before June 2021
Fixed in: Firmware per Dahua security advisory (SA-2021-0130)
Remediation for CERT-UA warns of active exploitation of Dahua cameras and
Patches
- Apply Dahua security advisory firmware updates for CVE-2021-33044 / CVE-2021-33045 (Dahua SA-2021-0130 / security advisory 957)
- Install the newest firmware; CISA KEV guidance is to apply vendor mitigations or discontinue use if none are available
Immediate actions
- Search Dahua devices for the backdoor account 'p2pwn' and remove it; note that recovery codes derived from the serial number may remain valid after account deletion
- Block or restrict inbound TCP/37777 from the internet and monitor for external connections to it
- Replace default and weak credentials (admin:admin, 666666, 888888, default) with strong unique passwords
- Review devices for unauthorized users and changed settings; factory reset and update firmware on suspected compromised devices
Workarounds
- Disable P2P / Easy4IP on devices where remote cloud access is not needed
- Block egress from camera VLANs except to required destinations
Longer-term hardening
- Remove Dahua cameras and recorders from direct internet exposure; place them on isolated VLANs behind VPN access
- Inventory Dahua devices and track firmware against the vendor download site
- Restrict or disable Easy4IP/P2P cloud connectivity where it is not required
CVEs associated with CERT-UA warns of active exploitation of Dahua cameras and
Weaknesses (CWE) in CERT-UA warns of active exploitation of Dahua cameras and
Timeline of CERT-UA warns of active exploitation of Dahua cameras and
- CVE-2021-33044 and CVE-2021-33045 (Dahua identity authentication bypass, CVSS 9.8) published in NVD; Dahua issues security advisory for firmware built before June 2021
- SBU identifies hacked cameras in two Kyiv residential buildings with footage redirected to YouTube (reported January 2024; exact day not stated, 15th is a placeholder for the month)
- CVE-2021-33044 added to the CISA Known Exploited Vulnerabilities catalog (due date 2024-09-11)
- Operation CameraSwarm setup and reconnaissance begin; brute-force engine deployed 18 June, first relay workflow tests 25 June
- Operator deploys the p2pwn CVE-2021-33044/CVE-2021-33045 authentication-bypass chain to plant the p2pwn backdoor account
- Largest exploitation wave observed; campaign totals 14,530+ compromised devices over 35 days (17 June - 22 July)
- Operator's staging server (154.86.119.60) exposes an open HTTP directory (2,616 files, 407 MB) crawled by Hunt.io AttackCapture, which had flagged TCP/37777 activity
- Hunt.io notifies national CERTs of the campaign
- Hunt.io publishes the Operation CameraSwarm report; coverage by BleepingComputer, The Hacker News and others follows
- The Record reports CERT-UA's advisory (issued late the prior week) warning of active exploitation of Dahua cameras and recorders via Easy4IP serial-number guessing, weak passwords and outdated firmware
Sources cited for CERT-UA warns of active exploitation of Dahua cameras and
- Ukraine warns hackers are exploiting Chinese-made Dahua surveillance cameras
- Operation CameraSwarm: Over 14,000 Dahua Cameras Compromised Across Ukraine and Russia (Hunt.io)
- Hackers Compromise 14,500 Dahua Web Cameras in 35-Day Campaign (BleepingComputer)
- Hackers Compromised 14,500 Dahua Devices (The Hacker News)
- Operation CameraSwarm: Inside the Toolkit Behind 14,530 Compromised Dahua Cameras (SecPod)
- NVD - CVE-2021-33044
- NVD - CVE-2021-33045
- Dahua Security Advisory (SA-2021-0130)
- CISA Known Exploited Vulnerabilities Catalog
- ITRES Labs: Dahua beyond CVE-2025-31702 - P2P relay exposure
Detection coverage for TL-2026-4457
As of 2026-10-26, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4457 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.