Ukraine’s CERT-UA warns attackers abuse Dahua cameras via P2P and authentication flaws

Ukraine’s CERT-UA issued an alert on Oct. 27, 2026, about unauthorized remote access to Dahua video surveillance systems. The State Special Communications Service of Ukraine said recorded cases involved video-stream access, configuration changes, and third-party accounts on IP cameras and DVRs.

CERT-UA has not said who attackers targeted, when infections occurred, how many devices attackers infected, or who was responsible, and the agency has not officially named those behind the current Ukrainian incidents. The agency said the findings resemble two Hunt.io-disclosed clusters that hit cameras in Ukraine and Russia.

Attackers mainly reach devices through Easy4IP, a peer-to-peer platform for monitoring Dahua IP cameras, NVRs, and DVRs. Users connect through smartphone apps or web browsers by scanning QR codes or entering hardware serial numbers. Dahua serial numbers follow a predictable structure with a ten-character model prefix shared by a device family. It also carries a five-character hexadecimal counter that rises almost sequentially, such as 7K01F36PCA003E8.

Attackers can guess serial numbers at scale through brute force to find cloud-connected devices without triggering rate limits or lockouts, and devices with active P2P functionality are at risk even if they do not connect directly to the internet. CERT-UA said an unknown serial number does not mean the device is secure.

Attackers defeat authentication with weak or known passwords or authentication bypass flaws in outdated firmware such as CVE-2021-33044 and CVE-2021-33045. The flaws carry a 9.8 out of 10 score and date to 2021, and Dahua has offered patches for both for years, though both remain on the US Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog.

Signs of compromise include unknown accounts, unauthorized configuration changes, and audit logs showing DVRIP authentication events from local address 127.0.0.1, a sign of P2P access. CERT-UA advises turning off P2P when it is not required, keeping devices off the public internet, and updating software.

Operation CameraSwarm, described by researchers as a lone-actor campaign, breached more than 14,530 Dahua IP cameras between June 17 and July 22, 2026, running at least 35 days and focusing on Ukraine and Russia. The campaign scanned TCP port 37777, Dahua’s default channel for proprietary management and video streaming.

Hunt.io found the campaign because the operator left an HTTP working directory unprotected, then pulled 407 megabytes of data across 2,616 files and 234 directories. The recovered material covered source code, shell history, images, exploitation results, logs and credentials. One brute-forcing system hit TCP port 37777 and breached 12,324 unique IP addresses across more than 13,000 recorded campaign attempts, researchers said.

Hunt.io said 1,923 cameras carried persistent p2pwn / p2password accounts installed through RPC following either bypass, and researchers said the toolkit creates recovery codes from camera serial numbers, allowing the operator to redeem new codes through Dahua’s password-recovery process without the current admin password.

The accounts sit apart from the admin password and survive password changes and, on most firmware versions, factory resets. Attackers abuse Dahua’s cloud relay to contact cameras behind network address translation when they know only the serial number, and Hunt.io said attackers contacted 283 cameras via Dahua’s cloud relay using serial numbers alone, typically without a device address or credentials.

Dutch intelligence agencies said earlier this year that Russian actors target IP cameras across the E.U., NATO countries, and Ukraine for espionage and military intelligence. A July 2026 bulletin said the actor uses automated imagery analysis and image recognition software to look for military vehicles and their cargo. The bulletin said the data covers E.U. and NATO transport routes, weapons bound for Ukraine, and locations of Ukrainian military personnel.

The bulletin said camera information is used in attempts to neutralize Ukrainian military personnel and destroy their military equipment. A Russian-speaking operator is attributed with one cluster that breached 58 internet-exposed cameras in Ukraine through known Dahua and Hikvision vulnerabilities.

One cluster relied on the Ingram webcam vulnerability scanner against Hikvision, D-Link, Reolink, and Dahua devices. The attackers exploited CVE-2017-7921 in Hikvision, CVE-2020-25078 in D-Link, CVE-2020-25169 in Reolink, CVE-2021-33044 and CVE-2021-33045 in Dahua, and CVE-2021-36260 in Hikvision. Researchers cited by Hunt.io said, “the operator’s focus settled on Russian and CIS telecom netblocks.” The actor also scanned and exploited TP-Link and MikroTik routers and cameras using CVE-2024-53375 and CVE-2024-57049 across 15 European countries.

Dahua Technology, founded in Hangzhou in 2001, is a publicly traded, partially state-owned Chinese company that ranks second in video surveillance revenue behind Hikvision. The company sells cameras, recorders, and network video recorders in about 180 countries through more than 2,100 partners, shipping tens of millions of devices worldwide.

phynnet reports that the SSSCIP confirmed the incidents as a significant escalation in attacks on critical surveillance infrastructure, and according to phynnet, access to video feeds could reveal troop movements, critical infrastructure, or civilian activity. According to phynnet, third-party accounts point to a persistent presence and potential lateral movement within networks.

Hunt.io said users should turn off P2P when it is not needed and install Dahua SA-2021-0130 firmware updates for CVE-2021-33044 and CVE-2021-33045 or a later version. Removing the backdoor account leaves the toolkit’s recovery codes valid until Dahua changes server-side derivation, and Hunt.io said cameras seen on port 37777 during June and July should be treated as potentially compromised; administrators should look for and remove any p2pwn account. Dahua has not publicly commented on the specific incidents, though it previously said it takes security seriously and provides updates.

Hunt.io told national CERTs and Dahua’s PSIRT about the CameraSwarm campaign on August 10. The toolkit included misleading references to CVE-2024-39943 and CVE-2025-31702, though the observed attacks exploited neither, and researchers found Russian-language comments in code that attackers had modified and inserted into repurposed public tools.