# CERT-UA warns of active exploitation of Dahua cameras and recorders via Easy4IP and CVE-2021-33044/CVE-2021-33045 (Operation CameraSwarm)

> Ukraine's CERT-UA warned that Chinese-made Dahua cameras and video recorders are being hacked by guessing serial numbers through the Easy4IP cloud feature, brute-forcing weak passwords and exploiting two 2021 authentication-bypass flaws on outdated firmware. Hunt.io's Operation CameraSwarm report documented 14,530+ Dahua devices compromised between 17 June and 22 July 2026, concentrated in Ukraine and Russia.

- **Published:** 2026-10-26T14:48:27Z
- **Last reviewed:** 2026-10-26T14:48:27Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4457
- **ID:** TL-2026-4457
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 26 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2021-33044, CVE-2021-33045, CVE-2025-31702

## Description

On or about the week before 26 October 2026, CERT-UA published an advisory warning that attackers are compromising internet-connected Dahua surveillance cameras and network video recorders. Reported attacker actions include gaining access to video feeds, remote device control, changing device settings and creating unauthorized user accounts. Access is obtained by guessing large numbers of predictable device serial numbers to identify cameras attached to Dahua's Easy4IP cloud service (which lets users reach devices remotely, including behind firewalls), by weak or default passwords, and by exploiting vulnerabilities in outdated firmware. CVE-2021-33044 and CVE-2021-33045 are named. Ukrainian authorities have previously reported camera hijacking: the SBU identified hacked cameras in two Kyiv residential buildings in January 2024 whose footage was redirected to YouTube.

The technical background comes from Hunt.io's Operation CameraSwarm report (published 18 August 2026). Hunt.io's AttackCapture crawler flagged activity on TCP/37777 (Dahua's binary management protocol) and on 23 July 2026 found the operator's staging server exposing an open HTTP directory containing 2,616 files (407 MB) of tooling, logs, shell history and campaign records. Between 17 June and 22 July 2026 a single, apparently Russian-speaking operator compromised 14,530+ unique devices through three parallel paths: (1) an asyncio credential brute-force engine against TCP/37777 (12,324 unique IPs, 13,229 campaign records; default wordlist entries such as admin:admin, 666666:666666, 888888:888888, admin:admin123, default:tluafed), with successful devices sent as snapshots to a Telegram bot and exported as SMART PSS-compatible XML; (2) the 'p2pwn' Go tool chaining CVE-2021-33044 (login with clientType set to NetKeyboard bypasses password validation) and CVE-2021-33045 (firmware trusts a claimed 127.0.0.1 source address in the request body rather than the TCP connection) to bypass authentication and install a persistent backdoor account p2pwn / p2password on 1,923 cameras, which Hunt.io reports survives password changes and, on most firmware, factory resets; and (3) abuse of the Easy4IP/P2P cloud relay (easy4ipcloud.com:8800, PTCP tunnel protocol) to reach 283 cameras, including devices behind NAT, using only the serial number plus SDK credentials; the operator claimed 89.4% of live serials exposed access without authentication (operator claim, unverified). An offline recovery-code generator derives administrative recovery codes from the serial number alone.

Operator tooling also included serial brute-forcers targeting 13 serial prefixes (1,048,576 candidates each), Shodan harvesting of dahuaddns.com / quickddns.com devices, masscan sweeps of TCP/37777 (Russian CIDR list at 10M pps), a Windows UPX-packed SalatStealer binary (xeno.exe / 1.exe) and a PowerShell script adding Microsoft Defender exclusions. Confirmed geolocated compromises were concentrated in Ukraine and Russia, with Ukraine the larger share; DH-IPC-K35P was the most frequently compromised model. Both CVEs are CVSS 9.8, affect firmware built before June 2021 on listed IP cameras, video intercoms, PTZ domes and thermal cameras, and are in the CISA KEV catalog (added 21 August 2024). No named threat actor is attributed; language artifacts indicate Russian-speaking operators.

## MITRE ATT&CK

- T1595.001 Scanning IP Blocks
- T1596.005 Scan Databases
- T1190 Exploit Public-Facing Application
- T1078.001 Default Accounts
- T1110.003 Password Spraying
- T1136.001 Local Account
- T1090 Proxy
- T1113 Screen Capture
- T1567.004 Exfiltration Over Webhook
- T1027.002 Software Packing
- T1685 Disable or Modify Tools

## Sources

- [Ukraine warns hackers are exploiting Chinese-made Dahua surveillance cameras](https://therecord.media/ukraine-cert-ua-warning-chinese-dahua-cameras-hacked)
- [Operation CameraSwarm: Over 14,000 Dahua Cameras Compromised Across Ukraine and Russia (Hunt.io)](https://hunt.io/blog/operation-cameraswarm-dahua-cameras-compromised)
- [Hackers Compromise 14,500 Dahua Web Cameras in 35-Day Campaign (BleepingComputer)](https://www.bleepingcomputer.com/news/security/hackers-compromise-14-500-dahua-web-cameras-in-35-day-campaign/)
- [Hackers Compromised 14,500 Dahua Devices (The Hacker News)](https://thehackernews.com/2026/08/hackers-compromised-14500-dahua-devices.html)
- [Operation CameraSwarm: Inside the Toolkit Behind 14,530 Compromised Dahua Cameras (SecPod)](https://www.secpod.com/learn/security-research/operation-camera-swarm-inside-the-toolkit-behind-14-530-compromised-dahua-cameras)
- [NVD - CVE-2021-33044](https://nvd.nist.gov/vuln/detail/CVE-2021-33044)
- [NVD - CVE-2021-33045](https://nvd.nist.gov/vuln/detail/CVE-2021-33045)
- [Dahua Security Advisory (SA-2021-0130)](https://www.dahuasecurity.com/support/cybersecurity/details/957)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [ITRES Labs: Dahua beyond CVE-2025-31702 - P2P relay exposure](https://labs.itresit.es/2025/10/29/dahua-beyond-cve-2025-31702-p2p-relay-exposure/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4457