CERT-UA: Attackers Hijack Dahua Cameras in Ukraine via P2P Service and Weak Authentication

The Computer Emergency Response Team of Ukraine (CERT-UA) has issued a warning about unauthorized remote access to video surveillance systems made by Dahua. According to Ukraine's State Special Communications Service, IP cameras and video recorders have been compromised: attackers gained access to video streams, changed device configurations and created third-party accounts.

A serial number as a password

The primary initial access vector is Easy4IP, a P2P platform that lets owners connect Dahua cameras and recorders to a smartphone app or browser by scanning a QR code or entering a serial number. The agency notes that serial numbers follow a predictable structure: a 10-character model prefix shared by an entire device family, plus a five-character hexadecimal counter that increments almost sequentially (for example, 7K01F36PCA003E8).

That makes it possible to guess serial numbers at scale and check whether a device is connected to the cloud, without running into rate limits or lockouts. Every device with P2P enabled is at risk, even those not directly reachable from the internet. "The assumption that the serial number is unknown to anyone is not a reason to consider the device secure," CERT-UA said.

Attackers get past authentication by using weak or known passwords, or by exploiting authentication bypass flaws in outdated firmware, notably CVE-2021-33044 and CVE-2021-33045.

Signs of compromise and defenses

CERT-UA listed indicators of compromise: unknown accounts, unauthorized configuration changes, and audit log entries showing authentication over Dahua's native DVRIP protocol from the local address 127.0.0.1 — a sign of P2P access. The agency recommends disabling P2P when it is not needed, keeping devices off the open internet and updating software promptly.

CERT-UA has not said who was targeted, when, how many devices were affected or who is responsible. The picture, however, resembles two campaigns previously described by Hunt.io.

Similar campaigns

The first is attributed to a Russian-speaking operator who targeted internet-exposed cameras in Ukraine using known Dahua, Hikvision, D-Link and Reolink vulnerabilities via the publicly available Ingram scanner, compromising 58 devices. In parallel, researchers say, the actor scanned and exploited TP-Link and MikroTik routers and cameras across 15 European countries.

The second, dubbed Operation CameraSwarm, is attributed to a lone actor. Between June 17 and July 22, 2026, they are believed to have compromised more than 14,530 Dahua cameras, combining credential brute-forcing with the CVE-2021-33044 and CVE-2021-33045 chain. The attack began by scanning TCP port 37777, and 1,923 cameras received a backdoor account, "p2pwn / p2password", stored separately from the admin password and surviving a password change and, on most firmware, a factory reset. Another 283 cameras were reached by serial number alone through Dahua's cloud relay, in most cases without credentials.

Earlier this year, Dutch intelligence agencies warned that Russian actors are breaking into IP cameras across the EU, NATO states and Ukraine for systematic espionage. According to them, footage is automatically analyzed with image recognition to find military vehicles and cargo, revealing military transport routes, weapon deliveries to Ukraine and the locations of Ukrainian troops.

Source: The Hacker News