Attackers hijack Dahua IP cameras in Ukraine via P2P access and weak authentication
A separate campaign has compromised thousands of Dahua cameras and planted backdoor accounts that survive password changes and most factory resets.
CERT-UA has warned that attackers are taking over Dahua video surveillance cameras and DVRs in Ukraine, gaining access to live video, altering device settings and creating extra accounts. The main entry point is Easy4IP, Dahua's peer-to-peer remote viewing service, where serial numbers follow a predictable pattern that can be guessed at scale, and weak passwords or outdated firmware with known bypass flaws (CVE-2021-33044 and CVE-2021-33045) finish the job. Separately, a campaign called Operation CameraSwarm is believed to have compromised over 14,530 Dahua cameras between June 17 and July 22, 2026, planting a persistent backdoor account on nearly 2,000 of them. Dutch intelligence has also warned that Russian actors use compromised cameras to gather military intelligence across the EU, NATO states and Ukraine. Operators should disable P2P if unused, keep cameras off the open internet and apply firmware updates.
Why it matters
The intrusions give attackers live video, the ability to change device settings and accounts that persist after the usual fixes, so a camera that was hijacked cannot be trusted again simply by changing its password. Dutch intelligence links the same kind of camera access to Russian efforts to gather military intelligence across the EU, NATO states and Ukraine, which puts these devices in a security role beyond their owners. Operators who leave the peer-to-peer service enabled, keep cameras reachable from the open internet or delay firmware updates are the ones most exposed to this pattern.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.