Hackers Compromised 14,500+ Dahua Devices Using Credential Attacks, Auth Bypasses, and P2P
-
Title: Operation CameraSwarm: Over 14,500 Dahua Devices Compromised via Credential Attacks and Auth Bypasses
Summary: Threat actors compromised more than 14,530 Dahua video surveillance devices in a campaign spanning from June 17 to July 22, 2026. The operation, tracked as Operation CameraSwarm, leveraged credential stuffing, two distinct authentication-bypass vulnerabilities, and a peer-to-peer (P2P) relay technique to gain unauthorized access. The findings were reconstructed from a 407 MB exposed working directory containing 2,616 files.
Body:
Researchers at Hunt.io have published a detailed analysis of a significant attack wave targeting Dahua devices. Between June 17 and July 22, 2026, at least 14,530 units were successfully compromised. The attackers employed a multi-pronged strategy combining brute-force credential attacks with exploitation of two separate authentication-bypass flaws, followed by the use of a P2P relay technique to maintain access and obfuscate command-and-control traffic.
The investigation was made possible by the discovery of a 407 MB working directory left exposed by the threat actors. This directory, containing 2,616 files, allowed researchers to reconstruct the entire kill chain and attribute the activity to a campaign now codenamed Operation CameraSwarm.
While the specific CVE identifiers for the authentication-bypass flaws were not disclosed in the initial reporting, the combination of weak credential reuse and unpatched vulnerabilities is cited as the primary vector for the initial compromise. The use of the P2P relay method is particularly noteworthy, as it leverages the devices' legitimate remote-access features to blend malicious traffic with standard operational data, making network-based detection more difficult.
This incident underscores the critical importance of changing default credentials, enforcing strong password policies, and ensuring firmware is updated to address known authentication bypasses. Organizations using Dahua equipment should immediately audit their device exposure and review P2P settings.
Source: The Hacker News
Original Article URL: https://thehackernews.com/2026/08/hackers-compromised-14500-dahua-devices.html
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login