Researchers uncovered CameraSwarm, a 35-day campaign that compromised more than 14,500 Dahua IP cameras, mainly in Ukraine and Russia, using brute-force logins, vulnerability exploits, and offline recovery codes. Hunt.io traced the operation after finding exposed attacker files, and Dahua camera owners are urged to check for the persistent p2pwn account and apply firmware fixes. #CameraSwarm #Dahua #Huntio #CVE-2021-33044 #CVE-2021-33045
Keypoints
- CameraSwarm compromised 14,530 Dahua IP cameras over 35 days.
- Most affected devices were located in Ukraine and Russia.
- Attackers used brute-force scanning, CVE-2021-33044, and CVE-2021-33045.
- The p2pwn tool installed a persistent backdoor account on many cameras.
- Hunt.io advised checking for compromise, removing p2pwn, and updating Dahua firmware.