CERT-UA reports attacks on Dahua cameras in Ukraine

CERT-UA has warned of unauthorised remote access to Dahua IP cameras and DVR installations in Ukraine. The alert notes that attackers compromised devices with access to video streams, altered configurations, and created third‑party accounts. The primary initial access vector is Easy4IP, a P2P platform enabling remote monitoring via a smartphone app or web interface by scanning a QR code or entering a device Serial Number (SN).

CERT-UA highlights that Dahua serial numbers have a predictable structure, consisting of a 10‑character model prefix (identical for all units in a family) and a five‑character hex counter that increments nearly sequentially. This enables large‑scale brute‑forcing to identify devices connected to the cloud, even when a device isn’t directly internet‑exposed, and raises the risk for any with active P2P functionality.

The agency notes that authentication barriers can be bypassed via weak or known passwords or by exploiting firmware authentication bypass flaws such as CVE-2021-33044 and CVE-2021-33045. Indicators of compromise include unknown accounts, configuration changes, and authentication events logged via the DVRP protocol from 127.0.0[.]1.

Two campaigns are described. One cluster, linked by Hunt[.]io to a Russian‑speaking operator, targeted internet‑exposed Dahua and Hikvision cameras across Ukraine, Russia and Europe, using flaws including CVE-2017-7921, CVE-2020-25078, CVE-2020-25169, CVE-2021-33044, CVE-2021-33045 and CVE-2021-36260, and resulted in 58 devices compromised.

The second campaign, Operation CameraSwarm, attributed to a lone actor, is said to have compromised over 14,530 Dahua cameras between 17 June and 22 July 2026 by combining credential brute‑forcing with CVE-2021-33044/CVE-2021-33045 exploitation, deploying persistent backdoors (p2pwn / p2password) on nearly 2,000 devices and reaching 283 cameras via the cloud relay with no address or credentials in many cases.

In some instances, attackers abused Dahua’s cloud relay to reach cameras behind NATs using only serial numbers. CERT-UA advises disabling P2P when not needed, avoiding internet exposure, and updating software. The Ukrainian alert leaves unanswered who was targeted, when infections occurred, how many devices were infected, or who is responsible.