Researchers discovered a large-scale campaign named CameraSwarm that compromised 14,530 Dahua IP cameras mostly in Ukraine and Russia between June 17 and July 22, 2026. The attackers used three main methods: brute forcing TCP port 37777 to access 12,324 devices, exploiting CVE-2021-33044 and CVE-2021-33045 vulnerabilities to install a persistent backdoor account on 1,923 cameras, and a cloud-relay attack targeting 283 cameras behind NAT using serial numbers and embedded SDK credentials. The backdoor account (p2pwn) persists through password changes and factory resets on most firmware versions. The attackers also abused Dahua's password recovery process by generating recovery codes from camera serial numbers, allowing access without knowing the current admin password. Hunt.io notified Dahua and national CERTs on August 10, 2026. Dahua recommends applying firmware updates addressing CVE-2021-33044 and CVE-2021-33045 and disabling P2P if not needed. Removing the backdoor account does not invalidate recovery codes, which remain usable until Dahua modifies the server-side mechanism.

The campaign resulted in unauthorized access to over 14,500 Dahua IP cameras, enabling attackers to capture camera snapshots and maintain persistent backdoor access on many devices. The backdoor account survives password changes and factory resets, increasing the difficulty of remediation. The abuse of the password recovery mechanism allows attackers to regain access without the current admin password. This compromises the confidentiality and integrity of the affected cameras and potentially any data or environments they monitor. The attack focused mainly on devices in Ukraine and Russia but involved global scanning. The persistence and multiple attack vectors increase the risk of long-term unauthorized surveillance and control.

Dahua has released firmware updates addressing CVE-2021-33044 and CVE-2021-33045 vulnerabilities; applying these updates or later versions is strongly recommended. Users should check their devices for the presence of the 'p2pwn' backdoor account and remove it if found. Disabling P2P functionality when not required can reduce exposure. Note that removing the backdoor account does not invalidate recovery codes generated by the attack toolkit; these remain valid until Dahua changes the server-side recovery code derivation mechanism. Owners of Dahua cameras reachable via TCP port 37777 during the campaign period should treat them as potentially compromised and take appropriate remediation steps.