Operation CameraSwarm: Over 14,000 Dahua cameras compromised across Ukraine and Russia

This report details CameraSwarm, an active mid-2026 campaign that compromised 14,530+ Dahua IP cameras worldwide using mass scanning, an asyncio credential brute-forcer, authenticated-bypass exploits (CVE-2021-33044/33045), and a P2P relay abuse that allowed access by serial number alone; it found ~1,923 cameras with a persistent backdoor account, 283 reachable via relay without credentials, transferable offline recovery codes, and a separately staged Windows stealer on the operator host, and it provides indicators, ATT&CK mapping, and mitigations.