Operation CameraSwarm: 14,500 Dahua Cameras Compromised Across Ukraine and Russia

Operation CameraSwarm: Hunt.io researchers discovered that a single operator compromised more than 14,500 Dahua and OEM-rebranded IP cameras over 35 days using three parallel paths — large-scale credential brute-forcing, two authentication-bypass chains that install persistent backdoor accounts, and abuse of P2P cloud relay access by serial number — with impacts concentrated in Ukraine and Russia and persistent backdoors found on nearly 1,923 devices; the toolkit and logs were recovered from an exposed HTTP host, and the report recommends patching, changing weak/default passwords, and disabling cloud P2P.