Attackers are hijacking Dahua IP cameras to watch the video and open their own accounts

Ukraine’s computer emergency response team, CERT-UA, has warned that attackers are taking over Dahua IP cameras and video recorders to watch live video streams, change device configurations and create rogue accounts. The alert, published through Ukraine’s State Special Communications Service, names two routes in: peer-to-peer remote access and weak authentication. CERT-UA has not said how many devices are affected, who the targets are or who is behind it.

Tech news in one quick read: Get the most interesting stories in startups, tech and programming, each with a short TLDR, in one daily email from TLDR.

Subscribe to TLDR →

We may earn a commission if you sign up.

The warning covers cameras, network video recorders and digital video recorders from Dahua, one of the largest makers of surveillance gear, without naming specific models. Its significance is that a device does not have to face the open internet to be reached. If its peer-to-peer feature is switched on, a stranger who guesses the right serial number may be able to get to it through the vendor’s own cloud.

Serial numbers as the weak point in Easy4IP

Easy4IP is Dahua’s peer-to-peer service, and its remote-viewing setup lets an owner add a device by scanning a QR code or typing the serial number. The Hacker News reports that the numbers are predictable: a 10-character model prefix shared by every unit in a family, followed by a 5-character hexadecimal counter that climbs nearly in sequence. Attackers can try them at scale and learn which devices are connected to the cloud without hitting rate limits or lockouts. CERT-UA’s position, as reported by The Hacker News, is that treating a serial number as unknown to outsiders does not make a device secure.

In some cases attackers used Dahua’s cloud relay to reach devices sitting behind home or office routers with only the serial number, a weakness ITRES researchers documented separately from a vulnerability tracked as CVE-2025-31702.

Hunt.io’s count of 14,530 cameras

Hunt.io’s report on Operation CameraSwarm puts numbers on the problem. It says a single operator compromised more than 14,530 Dahua cameras between 17 June and 22 July 2026. The operator swept TCP port 37777, Dahua’s default management and video port, collected serial numbers, then got in by brute-forcing default and weak passwords or by chaining CVE-2021-33044 and CVE-2021-33045, two authentication bypasses that Hunt.io says Dahua patched in October 2021. Ukraine held the largest share of confirmed compromises. Hunt.io notified national computer emergency teams on 10 August and published on 18 August.

After either bypass, the operator’s p2pwn tool installs a backdoor account named p2pwn with the password p2password over RPC. Hunt.io found it on 1,923 cameras. The account is stored separately from the admin password, so it survives a password change and, on most firmware, a factory reset. Another 283 cameras were reached only by serial number through the cloud relay, and Hunt.io says 89.4 percent of live serials returned an open channel that required no authentication. Hunt.io does not claim to know who wrote the operator’s tools and credits several open-source authors upstream.

Hunt.io says it learned the operation’s scale because the operator’s own server was crawled on 23 July, exposing 2,616 files totaling 407 MB. From the recovered logs it estimates about 13,000 device credentials came out of the productive runs. The brute-force engine, deployed on 18 June, reached 12,324 unique IP addresses, the cloud relay was first tested on 25 June and the vulnerability chain was put to work on 12 July. Hunt.io adds that the operator generated offline recovery codes from serial numbers that could grant administrative reset access through Dahua’s cloud, independent of any device credentials.

What CERT-UA tells owners to check

CERT-UA’s alert on the State Special Communications Service site lists signs of compromise: accounts nobody on the team created, unauthorized configuration changes, and audit-log entries showing authentication over Dahua’s proprietary DVRIP protocol from the local address 127.0.0.1, which suggests access through the peer-to-peer path. The recommended fixes are to disable peer-to-peer where it is not needed, keep devices off the direct internet, update firmware and remove unknown accounts.

The activity sits against a wider backdrop. In a bulletin dated 10 July 2026, the Dutch intelligence services AIVD and MIVD said in their cybersecurity advisory that Russian state actors are systematically conducting espionage through IP cameras in the Netherlands, other EU and NATO states and Ukraine. The Hacker News also describes a separate Russian-speaking operator that compromised 58 internet-exposed cameras in Ukraine, a campaign reported by Hunt.io.

Hunt.io’s separate account of a Russian-speaking operator shows how the same weaknesses are exploited with off-the-shelf tools. That operator used the public Ingram scanner against internet-exposed cameras in Ukraine, compromising 58 devices through flaws that include the Dahua bypasses, a Hikvision authentication bypass tracked as CVE-2017-7921, a D-Link credential disclosure and a Reolink information leak, as The Hacker News summarizes it. The Hacker News adds that the same actor was reported to have scanned TP-Link and MikroTik routers and cameras across 15 European countries, among them Poland, Romania, Germany and France.

CERT-UA has disclosed no target list, no device count, no timing of the infections and no attribution for the Dahua activity it warned about. The only numbers in the public record come from Hunt.io, whose 14,530 cameras describe one operator’s June and July run and not the intrusions CERT-UA is tracking.

This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.

Tech news in one quick read: Subscribe to TLDR →

We may earn a commission if you sign up.