Threat Actor Hacks 14,000 IP Cameras in Ukraine and Russia
A threat actor conducted "Operation CameraSwarm," compromising over 14,530 Dahua IP cameras across Ukraine and Russia between June 17 and July 22 The campaign chained three vulnerabilities (CVE-2021-33044, CVE-2021-33045, and CVE-20244-39943) to bypass authentication and deploy a persistent backdoor account (p2pwn/p2password) on 1,923 cameras The backdoor survives password changes and factory resets on most firmware, making it exceptionally difficult to remediate The attacker's toolkit was built
Analysis
TL;DR
- A threat actor conducted "Operation CameraSwarm," compromising over 14,530 Dahua IP cameras across Ukraine and Russia between June 17 and July 22
- The campaign chained three vulnerabilities (CVE-2021-33044, CVE-2021-33045, and CVE-20244-39943) to bypass authentication and deploy a persistent backdoor account (p2pwn/p2password) on 1,923 cameras
- The backdoor survives password changes and factory resets on most firmware, making it exceptionally difficult to remediate
- The attacker's toolkit was built at least one year in advance, incorporates modified code from four other developers, and appears designed for transferable access to a third party
- Hunt.io gained access to the threat actor's server, recovering 407 MB of data across 2,616 files that revealed the full scope of the campaign
Why It Matters
This campaign highlights the severe and ongoing risks posed by poorly secured IoT and surveillance devices, particularly those with known unpatched vulnerabilities. The use of chained CVEs and a persistent backdoor that survives factory resets demonstrates a sophisticated, well-resourced threat actor capable of long-term compromise at scale. For organizations relying on Dahua cameras—especially in critical infrastructure or government sectors—this underscores the urgency of network segmentation, firmware updates, and credential hygiene.
Technical Details
- Vulnerability chain: CVE-2021-33044 exploits unconditional trust in clients claiming to be NetKeyboard hardware controllers (password field is never evaluated), while CVE-2021-33045 exploits firmware reading the claimed source address from the request body rather than the actual TCP connection. CVE-20244-39943 was chained to deploy the backdoor.
- Backdoor persistence: The p2pwn/p2password account is deployed over Remote Procedure Call (RPC) and is stored independently of the admin password, surviving both password changes and factory resets on most firmware versions.
- Brute-force methodology: A publicly available asyncio framework was used for credential brute-forcing against 12,324 unique addresses, while a compiled Go binary handled the authentication bypass.
- NAT traversal: Attackers abused Dahua's cloud relay infrastructure to reach cameras behind NATs using only serial numbers, bypassing traditional network perimeter defenses.
- Infrastructure: The campaign infrastructure was established at least one year prior, with the toolkit containing both original code and modified code from at least four other developers, suggesting collaboration or code reuse within a broader threat ecosystem.
Industry Insight
- Organizations using Dahua IP cameras should immediately audit their deployments for the p2pwn backdoor, as standard remediation (password changes, factory resets) will not remove it; firmware updates or manual RPC account removal are required.
- The chaining of multiple CVEs and the use of a purpose-built Go binary indicate that threat actors are increasingly treating known IoT vulnerabilities as reusable attack chains, making proactive vulnerability management and network segmentation essential defenses.
- The transferable access design of the toolkit suggests a potential as-a-service or reseller model in the cybercrime ecosystem, meaning compromised devices may be sold or leased to additional operators, expanding the blast radius beyond the initial campaign.
Disclaimer: The above content is generated by AI and is for reference only.