Attackers Hijack Dahua IP Cameras in Ukraine Using P2P Access and Auth Weaknesses

Ukraine's CERT-UA has disclosed that threat actors are remotely hijacking Dahua IP cameras and DVRs to view live feeds, alter settings, and plant rogue accounts. The main entry point is Easy4IP, Dahua's peer-to-peer cloud feature, whose device serial numbers follow a predictable pattern (fixed model prefix plus an almost sequential hex counter), letting attackers brute-force valid IDs without triggering lockouts—meaning even cameras not directly exposed online can be reached through the cloud relay. Once a device is located, intruders break in using weak credentials or firmware authentication-bypass bugs CVE-2021-33044 and CVE-2021-33045, leaving traces such as unfamiliar accounts, configuration changes, and local DVRIP login events. The warning echoes separate Hunt.io research on two related campaigns—one tied to a Russian-speaking actor abusing Dahua, Hikvision, D-Link, Reolink, TP-Link and MikroTik flaws (including CVE-2017-7921, CVE-2020-25078, CVE-2020-25169, CVE-2021-36260, CVE-2024-53375, CVE-2024-57049) across 15 European countries, and another, Operation CameraSwarm, which compromised over 14,530 Dahua cameras and planted a persistent 'p2pwn' backdoor on roughly 2,000 devices surviving password resets and factory resets. Dahua users are urged to disable P2P if unused, keep devices off direct internet exposure, and update firmware promptly.