Хакеры взломали 14 500 камер Dahua всего за 35 дней

Security researchers at Hunt.io have uncovered the "CameraSwarm" campaign, which resulted in the compromise of over 14,500 Dahua IP cameras between June and July 2026. The attackers employed a multi-vector approach, primarily relying on brute-force attacks against exposed TCP port 37777 to gain access to more than 12,000 devices. Additionally, they leveraged legacy authentication bypass vulnerabilities CVE-2021-33044 and CVE-2021-33045 using the p2pwn tool, as well as exploiting the Easy4IP P2P infrastructure to infiltrate devices behind NAT.
The intrusion allowed threat actors to exfiltrate live camera footage and system data, with evidence suggesting that hardcoded SDK credentials facilitated unauthorized remote connections. Victims are advised to check for the presence of the malicious p2pwn account, update firmware to patch the identified CVEs, and disable unused P2P services to mitigate further risks.