Operation CameraSwarm: 14,000+ Dahua Cameras Compromised

An attacker's exposed working directory on an open HTTP server gave researchers at Hunt.io a rare inside view of an active campaign. After crawling and reconstructing 2,616 files, the team mapped out Operation CameraSwarm, which has compromised more than 14,000 Dahua security cameras across Ukraine and Russia.

The corpus reveals three parallel exploitation paths: an asyncio-based credential brute-forcer, an authentication-bypass chain using CVE-2021-33044/33045, and abuse of Dahua's P2P relay service to reach cameras directly by serial number. The relay path is notable because it never authenticates the connecting party — only the session — relying on a cloud-issued token obtainable through fixed SDK credentials baked into every Dahua client.

The analysis also corrects the record on two CVE identifiers found in the toolkit: CVE-2024-39943 is unrelated to Dahua and actually maps to a Rejetto HFS flaw, while CVE-2025-31702 covers a narrower post-authentication scenario, not the unauthenticated relay abuse — a separate issue documented by ITRES without a CVE. The writeup includes a full breakdown of the PTCP tunneling mechanism, including the Inverted STUN packet trick and bind-to-127.0.0.1 technique, while keeping attribution neutral and focused on how the campaign was built rather than who runs it.