A threat actor conducted Operation CameraSwarm, compromising over 14,530 Dahua IP cameras between June 17 and July 22, 2026, focusing on Russian and CIS telecom netblocks. The attacker used a brute-force engine targeting 12,324 unique IP addresses and deployed a persistent backdoor account (username/password: p2pwn/p2password) via Remote Procedure Call (RPC). This backdoor account is independent of the admin password and survives password changes and factory resets on most firmware versions. The attacker chained three vulnerabilities, including CVE-2021-33044 and CVE-2021-33045, to bypass authentication and gain full administrator sessions without credentials. They also exploited Dahua's cloud relay to reach cameras behind NATs using serial numbers. The attack infrastructure was established at least one year prior, and the toolkit includes code from at least four other developers. The report does not specify the attacker’s ultimate goal or use of the compromised devices.

The compromise of over 14,000 IP cameras allows the threat actor persistent unauthorized access, including a backdoor account that cannot be removed by password changes or factory resets on most affected firmware. This undermines the security and privacy of the affected devices and networks, potentially enabling surveillance, manipulation, or use of the cameras in further attacks. The exploitation of multiple authentication bypass vulnerabilities and abuse of cloud relay services increases the attack surface and reach of the threat actor.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The backdoor account persists through password changes and factory resets on most firmware, so simple credential changes or resets are insufficient. Users should monitor vendor advisories for official patches addressing CVE-2021-33044, CVE-2021-33045, and CVE-20244-39943. Network-level mitigations such as restricting access to camera RPC services and disabling cloud relay features where possible may reduce exposure until patches are available.