Operation CameraSwarm campaign targeting Dahua devices
Campaign
Summary
Hide ▲
Show ▼
The Operation CameraSwarm campaign compromised more than 14,530 Dahua devices, creating persistent camera access and raising unauthorized surveillance risk across affected networks. The activity ran from June 17 to July 22, 2026 and relied on credential attacks, CVE-2021-33044/CVE-2021-33045, and a P2P relay path. Confirmed compromises were concentrated in Ukraine and Russia. The operation also left 1,923 cameras with a persistent account and 283 devices reachable through the P2P route.
Cases
Related Happenings
Dahua cameras authentication-bypass vulnerabilities (multiple vulnerabilities)
Vulnerability
H score78
First: 19.08.2026 14:34
Last: 19.08.2026 14:34
Sources 1
How related:
The two 2021 flaws are authentication-bypass vulnerabilities in Dahua cameras and related products.
About this happening:
The CVE-2021-33044 and CVE-2021-33045 authentication-bypass flaws in Dahua cameras and related products remain an access risk because attackers can bypass device ident...
Dahua cameras authentication-bypass vulnerabilities (multiple vulnerabilities)
VulnerabilityHow related: The two 2021 flaws are authentication-bypass vulnerabilities in Dahua cameras and related products.
About this happening: The CVE-2021-33044 and CVE-2021-33045 authentication-bypass flaws in Dahua cameras and related products remain an access risk because attackers can bypass device ident...
CISA KEV guidance for Dahua IP camera authentication-bypass flaws (CVE-2021-33044, CVE-2021-33045)
Advisory/Mitigation
H score81
First: 19.08.2026 14:34
Last: 19.08.2026 14:34
Sources 1
How related:
As of August 19, 2026, both flaws remain listed in the U.S. Cybersecurity and Infrastructure Security Agency's (CISA) Known Exploited Vulnerabilities (KEV) catalog, which records them as Dahua IP camera authentication-bypass vulnerabilities and advises applying vendor mitigations or discontinuing use if mitigations are unavailable.
About this happening:
CISA kept CVE-2021-33044 and CVE-2021-33045 in the KEV catalog for Dahua IP camera authentication-bypass vulnerabilities, directing defenders to apply vendor...
CISA KEV guidance for Dahua IP camera authentication-bypass flaws (CVE-2021-33044, CVE-2021-33045)
Advisory/MitigationHow related: As of August 19, 2026, both flaws remain listed in the U.S. Cybersecurity and Infrastructure Security Agency's (CISA) Known Exploited Vulnerabilities (KEV) catalog, which records them as Dahua IP camera authentication-bypass vulnerabilities and advises applying vendor mitigations or discontinuing use if mitigations are unavailable.
About this happening: CISA kept CVE-2021-33044 and CVE-2021-33045 in the KEV catalog for Dahua IP camera authentication-bypass vulnerabilities, directing defenders to apply vendor...
CISA warning on FortiBleed for FortiGate customers
Public Sector Action
H score89
First: 19.06.2026 17:00
Last: 19.06.2026 17:00
Sources 1
About this happening:
CISA warned Fortinet customers with FortiGate appliances to secure exposed systems against ongoing malicious activity tied to FortiBleed. The activity had reached...
CISA warning on FortiBleed for FortiGate customers
Public Sector ActionAbout this happening: CISA warned Fortinet customers with FortiGate appliances to secure exposed systems against ongoing malicious activity tied to FortiBleed. The activity had reached...
Iran-linked Hikvision and Dahua surveillance camera targeting campaign
Campaign
H score37
First: 04.03.2026 17:00
Last: 04.03.2026 17:00
Sources 1
About this happening:
A coordinated campaign is targeting Hikvision and Dahua surveillance cameras across the Middle East, increasing the risk that compromised devices could support mil...
Iran-linked Hikvision and Dahua surveillance camera targeting campaign
CampaignAbout this happening: A coordinated campaign is targeting Hikvision and Dahua surveillance cameras across the Middle East, increasing the risk that compromised devices could support mil...
Timeline
-
19.08.2026 14:34 2 articles · 5h ago
Hunt.io discloses Operation CameraSwarm against Dahua devices
Initial DisclosureHunt.io says Operation CameraSwarm compromised more than 14,530 Dahua devices between June 17 and July 22, 2026 by combining credential attacks, CVE-2021-33044, CVE-2021-33045, and a P2P relay path; the researchers say 1,923 cameras were configured with a persistent account, 283 were reached through P2P, and confirmed compromises were concentrated in Ukraine and Russia. Users of affected Dahua products are advised to install the corresponding fix software or newer firmware, and ITRES Labs recommends disabling P2P where it is not required and checking firmware against the vendor's download site.
Show sources
- Hackers Compromised 14,500+ Dahua Devices Using Credential Attacks, Auth Bypasses, and P2P — thehackernews.com — 19.08.2026 14:34
- Hackers Compromised 14,500+ Dahua Devices Using Credential Attacks, Auth Bypasses, and P2P — thehackernews.com — 19.08.2026 14:34