Operation CameraSwarm: 14,000+ Dahua Cameras Compromised

Between June and July 2026, an operator attributed to Purple Ghosts executed 'Operation CameraSwarm', resulting in the compromise of over 14,530 Dahua IP cameras, primarily located in Ukraine and Russia. The attacker utilized a multi-faceted exploitation strategy including internet-wide scanning for port 37777, credential brute-forcing, and the exploitation of two critical authentication-bypass vulnerabilities (CVE-2021-33044 and CVE-2021-33045) to gain administrative access.

Technically, the campaign utilized 'p2pwn', a custom Go-based toolkit that multiplexes raw SDK channels, HTTP CGI, and JSON-RPC to install persistent backdoor accounts (p2pwn / p2password) that survive factory resets. The operator also abused Dahua's cloud P2P relay infrastructure (easy4ipcloud[.]com) using hardcoded vendor credentials to reach devices behind NAT by serial number alone. Additionally, a secondary capability involving SalatStealer (a Windows credential stealer) was staged on the same infrastructure, accompanied by a robust PowerShell-based evasion script targeting Windows Defender.

This campaign represents a significant threat to the security of IoT ecosystems and physical security infrastructure. The ability to generate offline, deterministic recovery codes for Dahua devices enables transferable administrative access, suggesting a high potential for access brokering. Organizations using Dahua or OEM-rebranded hardware (Amcrest, Lorex, Annke, etc.) must urgently audit account lists and update firmware to invalidate these recovery mechanisms.