The Computer Emergency Response Team of Ukraine (CERT-UA) has issued an urgent public advisory warning organizations and citizens about unauthorized remote access vulnerabilities affecting video surveillance systems manufactured by Dahua. The security alert highlights a growing campaign targeting Internet Protocol (IP) cameras, network video recorders (NVRs), and digital video recorders (DVRs), exposing significant flaws in peer-to-peer cloud infrastructure that allow threat actors to bypass standard perimeter defenses.
According to an official alert released by the State Special Communications Service of Ukraine (SSSCIP), investigators have recorded numerous cases of attackers compromising Dahua IP cameras and recording devices. In these incidents, unauthorized actors successfully gained access to live video streams, modified critical device configurations, and established malicious third-party user accounts to maintain long-term persistence within targeted networks.
The primary initial access vector exploited in these ongoing attacks relies on Easy4IP, a proprietary peer-to-peer (P2P) platform designed by Dahua. This platform allows residential and small business users to remotely monitor physical spaces through smartphone applications or web browsers simply by scanning a Quick Response (QR) code or entering a hardware serial number. While convenient for end-users, the underlying architectural design of the P2P connection mechanism introduces profound security risks when combined with weak authentication or exposed management interfaces.
Security researchers and government agencies have revealed that Dahua device serial numbers follow a predictable structure. This pattern consists of a ten-character model prefix that remains identical across all units within the same product family, followed by a five-character hexadecimal counter that increments almost sequentially, such as 7K01F36PCA003E8. This predictability enables malicious actors to execute automated brute-force attacks at scale. By systematically guessing serial numbers, attackers can determine whether specific cameras are actively connected to the cloud service without triggering rate-limiting protocols or account lockouts. Consequently, any device with active P2P functionality remains vulnerable, even if it is safely tucked behind a network address translator (NAT) and lacks direct exposure to the public internet.
Emphasizing the severity of the flaw, CERT-UA noted that assuming a device serial number remains hidden from unauthorized eyes is no longer a valid security baseline. Authentication barriers are routinely overcome by adversaries leveraging weak or default administrator passwords, or by exploiting authentication bypass vulnerabilities residing in outdated firmware versions, most notably CVE-2021-33044 and CVE-2021-33045. To combat these threats, cybersecurity authorities advise users to disable the P2P feature entirely if remote cloud viewing is not strictly required, to avoid exposing management ports directly to the internet, and to ensure that all device software and firmware are updated to the latest vendor-supplied versions.
While Ukrainian officials have not publicly disclosed specific target lists, the exact timing of individual infections, the precise aggregate number of compromised units, or the ultimate identity of the responsible threat actors, these findings mirror sophisticated cyber espionage campaigns recently uncovered by private threat intelligence firms. In particular, the tactics closely align with separate telemetry data published by security platform Hunt.io regarding targeted intrusions against IP camera infrastructure in Ukraine and surrounding regions.
One notable campaign analyzed by researchers has been attributed to a Russian-speaking operator who specifically singled out internet-exposed surveillance hardware in Ukraine. This threat actor leveraged known security flaws in Dahua and Hikvision devices to successfully compromise dozens of terminals. The operational workflow integrated Ingram, a publicly available automated webcam vulnerability scanner, to rapidly map and exploit vulnerable units. Concurrently, the same threat actor expanded their scanning and exploitation framework to target TP-Link and MikroTik routers and cameras by weaponizing vulnerabilities such as CVE-2024-53375 and CVE-2024-57049 across fifteen European countries, including Poland, Romania, Moldova, Hungary, Czechia, Slovakia, Bulgaria, Germany, France, the Netherlands, Italy, Spain, the United Kingdom, Austria, and Ukraine.
A second major campaign, tracked under the codenamed Operation CameraSwarm and attributed to a lone, highly focused threat actor, managed to compromise over 14,530 Dahua IP cameras between mid-June and late July. This operation utilized a hybrid strategy combining credential brute-force attacks with the exploitation of the CVE-2021-33044 and CVE-2021-33045 vulnerability chain. The attack sequence typically begins by scanning the internet for TCP port 37777, the default proprietary management and video streaming port utilized by Dahua architecture. Once open ports are identified, the attackers harvest serial numbers, breach the hardware via the aforementioned exploitation methods, and subsequently deploy a persistent backdoor account commonly referenced as p2pwn or p2password.
Security disclosures from Hunt.io highlighted that nearly 2,000 cameras were fitted with this persistent backdoor account installed via remote procedure calls after an authentication bypass. Because the backdoor is stored independently of the primary administrator credentials, it successfully survives standard password modifications and, on the vast majority of affected firmware versions, even withstands a complete factory reset. Furthermore, investigations revealed that hundreds of cameras were reached solely through their serial numbers via Dahua’s cloud relay mechanism, requiring no direct device network address and, in many cases, bypassing credentials entirely. By abusing Dahua’s cloud relay infrastructure, attackers easily navigated behind NAT configurations to reach sequestered hardware.
These technical findings substantiate broader intelligence warnings issued earlier this year by European authorities. In July, Dutch intelligence agencies released a comprehensive cybersecurity advisory warning that Russian state-sponsored actors were actively compromising IP cameras across European Union member states, NATO nations, and Ukraine to conduct systematic digital espionage and acquire high-value military intelligence.
According to the intelligence advisory, these threat actors utilize automated image recognition software to process video feeds and conduct targeted searches for military vehicles, convoy movements, and the transport of heavy military cargo. This illicit access provides hostile operators with critical tactical data, including allied military supply routes, weapon delivery schedules destined for Ukraine, and the precise physical locations of Ukrainian military personnel. Intelligence reports indicate that information extracted from compromised IP cameras in Ukraine is actively weaponized to direct strikes intended to neutralize Ukrainian military personnel and destroy vital defense material.
