CERT-UA Warns of Hijacked Dahua IP Cameras in Ukraine

The Computer Emergency Response Team of Ukraine (CERT-UA) has warned of unauthorized remote access to video surveillance systems made by Dahua. Attackers are compromising IP cameras and DVRs, changing device configurations, and creating third-party accounts. The agency says the main initial access route is the Easy4IP peer-to-peer platform, alongside weak or known passwords and authentication bypass flaws in outdated firmware.

How attackers gain access

Easy4IP allows users to remotely monitor homes or small businesses by connecting Dahua IP cameras, NVRs, and DVRs via a smartphone app or web browser by scanning a QR code or entering the hardware serial number. The serial numbers have a predictable structure: a 10-character model prefix identical for all units of the same device family and a five-character hexadecimal counter incremented almost sequentially, such as 7K01F36PCA003E8. This allows attackers to guess them at scale through brute force and identify if they are connected to the cloud without rate limits or lockouts. As a result, all devices with active P2P functionality are at risk even if they cannot be accessed directly via the internet. Authentication barriers are overcome by leveraging weak or known passwords, or by exploiting authentication bypass vulnerabilities in outdated firmware versions, such as CVE-2021-33044 and CVE-2021-33045. CERT-UA said the assumption that the serial number is unknown to anyone is not a reason to consider the device secure.

Indicators and mitigation

CERT-UA shared indicators of compromise: the presence of unknown accounts, unauthorized configuration changes, and audit logs containing authentication events using the manufacturer's native protocol (DVRIP) and from a local address (127.0.0.1), a sign of P2P access. To counter the threat, it is advised to disable the P2P feature if not required, avoid exposing the devices directly to the internet, and keep the software up-to-date. The agency has not disclosed who was targeted, when these infections occurred, how many devices had been infected, or who was responsible for the activity.

Related campaigns and espionage concerns

The findings share similarities with two clusters of activity that Hunt.io disclosed as targeting IP cameras in Ukraine and Russia. One campaign, attributed to a Russian-speaking operator, singled out internet-exposed cameras in Ukraine using known Dahua and Hikvision vulnerabilities, including CVE-2021-33044 and CVE-2021-33045, and compromised 58 devices. The same threat actor is also said to have scanned and exploited TP-Link and MikroTik routers and cameras using CVE-2024-53375 and CVE-2024-57049 across 15 European countries. The second campaign, Operation CameraSwarm, attributed to a lone threat actor, is believed to have compromised over 14,530 Dahua IP cameras between June 17 and July 22, 2026, using credential brute-force attacks and the CVE-2021-33044 to CVE-2021-33045 chain. It scans TCP port 37777, collects serial numbers, breaks into devices, and deploys a persistent backdoor account ('p2pwn / p2password') on nearly 2,000 cameras. Hunt.io noted that 1,923 cameras carry the backdoor, stored independently of the admin password and surviving a password change and, on most firmware, a factory reset. It also noted that 283 cameras were reached by serial number alone through Dahua's cloud relay. In some instances, attackers abuse Dahua's cloud relay to reach cameras behind NATs using only serial numbers. Dutch intelligence agencies warned earlier this year that Russian actors are compromising IP cameras across the E.U., NATO states, and Ukraine for systematic digital espionage and military intelligence.

Sources: The Hacker News