Dahua Camera Backdoor Survives Password Changes and Factory Resets: Inside Operation CameraSwarm
Quick Answer: A campaign dubbed Operation CameraSwarm compromised 14,530+ Dahua cameras and planted a persistent backdoor account on 1,923 of them that survives password changes and factory resets. Check for a "p2pwn" account and patch immediately.
Last verified: September 6, 2026
Picture this: a SOC analyst gets a ticket flagged low-priority — "unusual login on a lobby camera." Routine stuff, so the fix is routine too. Reset the password. Maybe factory-reset the device for good measure. Ticket closed.
Except this time, the intruder never left. According to a report from threat-intelligence firm Hunt.io, an operator running a campaign called Operation CameraSwarm planted a hidden administrative account on thousands of Dahua IP cameras — an account stored completely separately from the normal admin credentials. Change the password all you want. Reset the device to factory settings. The account often survives both.
That single design flaw turns what looks like a contained incident into something far messier: a persistence mechanism that outlives the standard incident-response playbook.
Table of Contents
- What Actually Happened
- Three Attack Paths, Running in Parallel
- How the Persistent Backdoor Works
- Indicators of Compromise
- Detection Checklist
- Prevention and Hardening Commands
- Expert Tips
- FAQ
- Conclusion
What Actually Happened
Hunt.io's researchers say the campaign ran for roughly 35 days, between June 17 and July 22, 2026. Confirmed compromises were concentrated in Ukraine and Russia, with additional activity touching Mexico and Vietnam. In total, more than 14,530 internet-exposed Dahua devices were affected.
The discovery itself came down to operator error. On July 23, Hunt.io's AttackCapture crawler found an open HTTP directory sitting on one of the operator's own servers — 2,616 files across 234 subdirectories, roughly 407MB of data. That single exposed folder handed researchers the entire operation: scanning engines, exploit tooling, exfiltrated camera images, credential logs, and shell history.
According to Hunt.io's write-up, the toolkit wasn't built by one author — it was assembled from components credited to multiple developers, stitched together into a working pipeline rather than a single custom-built platform.
Three Attack Paths, Running in Parallel
What makes CameraSwarm worth a SOC team's attention isn't novelty — none of the underlying flaws are new. It's the layering. Three separate techniques ran side by side against the same device population:
1. Credential Brute-Forcing (12,324 devices)
An automated scanner targeted TCP port 37777 — the port Dahua's Easy4IP management protocol listens on — and worked through a list of default and weak credentials. Successful logins triggered automatic snapshot capture, with results piped to a Telegram channel and exported in a format compatible with Dahua's SMART PSS management platform.
2. Authentication Bypass (1,923 devices)
This path exploited two long-known Dahua vulnerabilities, CVE-2021-33044 and CVE-2021-33045, both authentication-bypass flaws that Dahua's own advisory rates at 8.1 CVSS (NVD currently scores each at 9.8). Per Dahua's advisory, attackers can bypass device identity checks by crafting malicious data packets — no valid password required.
3. P2P Relay Abuse (283 devices)
The most unusual path skipped IP scanning entirely. Dahua's Easy4IP cloud relay lets legitimate owners reach their cameras from anywhere without configuring port forwarding — convenient, until an attacker realizes the same relay can be queried with nothing but a device serial number. Security firm ITRES Labs, cited in Hunt.io's report, notes that the relay establishes a route before any authentication occurs, leaving login checks entirely to the device's own web application. That means cameras sitting safely behind a home or office router — no public IP, no port forwarding — were still reachable.
How the Persistent Backdoor Works
Here's the part that should worry defenders most. Once the auth-bypass path succeeded, a tool the operator called p2pwn created a new account through the camera's remote-management interface — separate from the built-in administrator account entirely.
Because it lives outside the normal credential store, a password change on the admin account does nothing to it. On most affected firmware versions, even a full factory reset failed to remove it. Hunt.io counted 1,923 cameras carrying this account, typically named p2pwn or p2password.
It gets worse. The toolkit also included an offline recovery-code generator — a way to produce valid password-recovery codes for a device without ever knowing its current credentials. According to Hunt.io, of the live serial numbers tested, 89.4 percent returned a relay channel with no authentication requirement at all. Even after an unauthorized account is manually removed, previously generated recovery codes can remain usable until Dahua changes how those codes are derived server-side.
Analysts note: the toolkit itself mislabels its techniques. The persistent-account method is internally tagged as CVE-2024-39943 — but that CVE actually describes an unrelated command-injection flaw in Rejetto's HTTP File Server, a completely different product. Likewise, the relay-abuse path is tagged CVE-2025-31702, which Dahua's own advisory describes as a narrower, authenticated privilege-escalation bug — not the unauthenticated relay behavior documented here. Hunt.io flags this explicitly: chasing the wrong CVE number can send a defender patching the wrong thing entirely.
One more wrinkle worth flagging for enterprise SOC teams specifically: Hunt.io also found a UPX-packed Windows binary — assessed as SalatStealer — staged on the same operator infrastructure, alongside a PowerShell script capable of disabling Windows Defender through several methods, including a Group Policy key designed to survive reboots and Defender updates. Researchers treat this as an unrelated capability riding on shared infrastructure, not part of the camera campaign itself — but it's a reminder that operator servers rarely host just one tool.
Indicators of Compromise
The following indicators are defanged. Re-fang only inside a controlled threat-intel platform such as MISP, VirusTotal, or your SIEM.
| Type | Indicator | Notes |
|---|---|---|
| Port | 37777/TCP | Dahua Easy4IP management protocol targeted by the brute-force engine |
| Account | p2pwn / p2password | Persistent unauthorized camera account — primary artifact to search for |
| Domain:Port | easy4ipcloud[.]com:8800 | Legitimate Dahua P2P relay endpoint, abused rather than compromised |
| Domains | dahuaddns[.]com, quickddns[.]com | Legitimate Dahua DDNS services abused for serial-number enumeration |
| Default credentials | admin:admin, 666666:666666, 888888:888888 | Sample of default pairs used in the brute-force list |
| Windows path artifact | C:\Users\SystemX\Downloads\seria | Development path exposed in operator test logs |
Full IOC sets, including operator server IPs and file hashes, are available in Hunt.io's original report and were also reproduced by Cyber Security News.
Detection Checklist
If your organization runs Dahua cameras — or OEM-rebranded lines built on the same backend, including several third-party brands — treat any device that was reachable on port 37777 between June and July 2026 as potentially compromised.
- Log into each camera's user-management panel and look for an account named
p2pwnorp2password— or any account you don't recognize creating or setting. - Check whether P2P/cloud-relay features are enabled when they aren't actually needed.
- Review firmware version against Dahua's SA-2021-0130 advisory, which addresses CVE-2021-33044 and CVE-2021-33045.
- On the network side, watch for repeated authentication attempts on TCP/37777 and unusual outbound traffic to Telegram API endpoints from camera VLANs.
- For enterprise networks, have the Windows security team check for broad Defender exclusions or Group Policy changes that weren't authorized — a signal tied to the unrelated stealer payload found on the same operator infrastructure.
Prevention and Hardening Commands
The following are standard network-hardening and diagnostic commands — nothing here is offensive tooling, and none of it should be run against devices you don't own or manage.
Check whether a camera's management port is exposed to the internet:
nmap -p 37777 --open [camera_IP_range]This scans a specified IP range for hosts responding on Dahua's management port. Run it against your own asset inventory, never against ranges you don't control. Expected output: a list of hosts with port 37777 open, which should then be checked against your firewall rules — that port has no reason to be internet-facing.
Isolate camera traffic on its own VLAN and block outbound internet access except to required update servers:
iptables -A FORWARD -s [camera_VLAN_subnet] -d 0.0.0.0/0 -j DROP
iptables -A FORWARD -s [camera_VLAN_subnet] -d [dahua_update_server] -j ACCEPTThis is a basic default-deny pattern: block the camera subnet from reaching the general internet, then explicitly allow only what's required for firmware updates. Adjust to your actual firewall platform and confirm the update server addresses with Dahua's official documentation before deploying.
Beyond the command line: disable P2P/cloud relay in each camera's settings if remote access isn't a business requirement, rotate every credential the camera or its connected NVR ever held, and apply the vendor's current firmware — not just the SA-2021-0130 fix, but whatever is most recent, since recovery-code generation is tied to firmware-side logic that Dahua controls.
Expert Tips
- Don't trust a password reset alone. On IoT devices with proprietary management stacks, a "clean" reset doesn't guarantee a clean device the way it does on a standard Linux server. Treat firmware reflash and account audit as the real remediation step, not the password change.
- Verify CVE numbers before you patch. This campaign is a textbook example of why: two of the technique labels in this toolkit point to the wrong CVE entirely. Cross-check against the vendor's own advisory, not just whatever identifier shows up in a report or ticket.
- Audit convenience features, not just known vulnerabilities. The P2P relay wasn't a bug — it was a legitimate feature repurposed. Any "connect from anywhere" convenience feature on IoT gear deserves the same scrutiny as an exposed admin panel.
Related Cybersecurity Topics You Should Explore
- Is Your Driver's License for Sale? 153 Million Records Leaked, FBI Investigates
- QR Code Phishing Just Hit Record Levels: What SOCs Must Know Now
- Microsoft Teams Won't Load? Inside the TM1466820 Windows Bug
- Why Ad Networks Get Your Blogger Blog Locked (Fix It Fast)
- The touch Command Trick Attackers Use to Fake File Timestamps
- WordPress Now Uses AI to Catch Security Flaws Before Hackers Do
- Mini Shai-Hulud Worm Hits npm Package With 150K Weekly Downloads
- more vs less Linux Commands: The SOC Analyst's Log Review Guide
- JFrog Artifactory Hacked: Attackers Are Minting Admin Tokens
- tail -f Explained: The Linux Command That Beats Your SIEM's Delay
- Brave Browser Now Hides Your Real Email From Every Website
- D-Link Router Flaw Lets Hackers Steal Your Wi-Fi Password
- 'This Blog Has Been Locked' — How to Backup Blogger the Right Way
- cPanel Zero-Day Lets Hackers Seize Root Control of Your Server
FAQ
Q: Does a factory reset remove the Dahua camera backdoor?
A: Not reliably. Researchers found the persistent account survives factory resets on most affected firmware versions, since it's stored independently of the standard configuration.
Q: Which Dahua vulnerabilities were exploited in Operation CameraSwarm?
A: CVE-2021-33044 and CVE-2021-33045, both authentication-bypass flaws Dahua rated 8.1 CVSS in its own advisory, patched under SA-2021-0130.
Q: How many devices were affected?
A: Hunt.io reports more than 14,530 cameras compromised in total across all three attack paths, with 1,923 receiving the persistent backdoor account specifically.
Q: Is my camera affected if it's behind my home router?
A: Possibly, yes. The P2P relay path reached cameras behind NAT using only their serial number, bypassing the protection a router normally provides.
Q: Was this a zero-day attack?
A: No. Every technique used relies on known, patchable vulnerabilities or weak default credentials — the campaign's danger is in its persistence and layering, not novelty.
Q: What should I do right now if I run Dahua cameras?
A: Check for unauthorized accounts, disable unused P2P features, confirm firmware is current, and rotate every credential associated with the device and any connected NVR.
Conclusion
Operation CameraSwarm isn't a story about a brilliant new exploit — every technique involved is years old and patchable. It's a story about what happens when persistence outlives the incident response designed to stop it. A password reset that doesn't reset anything, and a factory reset that doesn't factory-reset anything, breaks the basic assumption most IR playbooks are built on.
If your organization has Dahua gear — or any surveillance hardware built on a similar OEM backend — this is worth an afternoon of your SOC's time before it becomes a much longer incident.
Found this useful? Share it with your SOC team, and drop a comment if you've found a p2pwn-style account on your own gear — real-world reports help the whole community stay ahead of this one.
Analysis based on SOC monitoring and public threat intelligence review.