Summary
- Hunt.io says one operator compromised more than 14,530 Dahua devices between 17 June and 22 July.
- Researchers found persistent backdoor accounts on 1,923 cameras and a route to hundreds of devices using serial numbers and cloud relay infrastructure.
- The campaign exposes security dependencies that continue beyond a customer's local firewall or device password.
A single operator compromised more than 14,500 Dahua IP cameras in 35 days, according to research that exposes how surveillance systems can remain reachable through credentials, authentication weaknesses, and cloud connectivity even when devices sit behind local network boundaries.
Hunt.io said it recovered the operator’s working environment from an openly accessible server on 23 July, obtaining 407MB of material spread across 2,616 files and 234 directories. The researchers reconstructed activity running from 17 June to 22 July and identified at least 14,530 compromised devices.
The scanning activity was global, but confirmed geolocated compromises were concentrated in Ukraine and Russia, with Ukraine accounting for the largest share. Hunt.io has not identified the operator behind the campaign, and the use of regional infrastructure does not establish state sponsorship.
The scale is only one part of the finding. Researchers identified three parallel access methods, including password attacks, authentication bypass techniques, and a method that abused Dahua’s peer-to-peer cloud relay system. Hunt.io said 1,923 cameras carried a persistent backdoor account installed after compromise.
That account was stored separately from the normal administrator password and, according to the research, survived password changes and most factory resets. If accurate across the affected firmware estate, the result complicates incident recovery: resetting an ordinary credential may give administrators confidence without actually removing the attacker’s access.
A second finding concerns 283 cameras reached through serial numbers and Dahua’s cloud relay infrastructure. Hunt.io said the operator’s code recorded that most live serial-number targets in this subset could establish a channel without conventional authentication. The researchers also documented offline recovery-code techniques capable of producing administrative access independently from the normal device credentials.
Cloud relays are useful precisely because they solve a difficult operational problem. Cameras deployed in branches, warehouses, public buildings, factories, and remote sites may sit behind network address translation or firewalls that make direct inbound connections inconvenient. Vendor relay services allow administrators and mobile applications to reach those systems without exposing a conventional management port.
The same architecture changes the security boundary. A local firewall may prevent direct connections to a camera’s IP address, yet the device can still maintain an outbound relationship with vendor infrastructure that creates another path for remote management. Security therefore depends not only on the customer’s network configuration, but also on device identity, serial-number handling, recovery processes, firmware behaviour, and the design of the vendor’s relay service.
Hunt.io also cautioned against simplistic interpretation of vulnerability identifiers embedded in the attacker’s toolkit. Two CVE labels used by the operator did not accurately describe the techniques observed. That distinction is useful because copied exploit code and attacker tooling often preserve inaccurate labels long after techniques have been modified or repurposed.
The researchers notified relevant national CERTs on 10 August and contacted Dahua’s product-security team before publication. The report was held until 18 August while the disclosure process continued.
The affected devices illustrate why physical-security systems belong inside enterprise cyber inventories rather than being treated purely as facilities equipment. Network cameras can contain processors, operating systems, remote-management services, cloud dependencies, credentials, and long support lifecycles. They are computers positioned in unusually sensitive locations, often with the additional ability to observe physical activity.
CameraSwarm demonstrates how those characteristics can be assembled into an attack surface at scale. The open question is how many devices remain persistently accessible after the operator’s campaign ended — and whether owners can distinguish a camera that has merely had its password changed from one that has actually been returned to a trusted state.
