Hunt.io researchers uncovered Operation CameraSwarm, a campaign that compromised 14,530+ Dahua devices using credential attacks, auth bypasses, and P2P relays.
Cybersecurity researchers at Hunt.io have pulled back the curtain on a chilling campaign that quietly compromised more than 14,530 Dahua devices between June 17 and July 22, 2026. Dubbed Operation CameraSwarm, this wasn't a single clever exploit. It was a multi-pronged assault that combined credential stuffing, two separate authentication-bypass flaws, and a peer-to-peer (P2P) relay technique to build a sprawling botnet of surveillance cameras.
If that number feels abstract, think about it this way: that's roughly the population of a small town, and every single one of those devices was a pair of eyes that got turned against its owner. The researchers pieced together this entire operation from a 407 MB exposed working directory filled with 2,616 files. It's like finding the attacker's diary, complete with their shopping lists and battle plans.
### Why This Attack Is Different From the Usual Botnet
We've all heard about IoT botnets before. Mirai turned thousands of routers into cannon fodder for massive DDoS attacks. But Operation CameraSwarm feels more personal, more invasive. These weren't just dumb pipes for flooding a website with traffic. These were cameras sitting in living rooms, parking lots, and warehouses.
- **Credential Attacks:** The attackers didn't need to break in through a locked door. They simply tried millions of username and password combinations, banking on the fact that many people never change the default admin credentials on their devices.
- **Auth Bypasses:** Two separate zero-day flaws in the camera's web interface allowed the attackers to skip the login screen entirely. No password needed, just a carefully crafted request.
- **P2P Relay:** Instead of having every compromised camera phone home to a single command-and-control server (which is easy to take down), the attackers used a peer-to-peer mesh. Each camera talks to its neighbors, making the network incredibly resilient and hard to dismantle.
The exposed directory was the smoking gun. It contained logs, scripts, and even screenshots from the compromised devices, giving researchers a terrifyingly clear view of how the operation ran on a day-to-day basis.
### What This Means for Your Security Posture
If you own a Dahua device, or really any IP camera, this should be a wake-up call. The researchers noted that the attack wasn't particularly sophisticated in its early stages. It relied heavily on people's bad habits. The authentication bypasses, however, are a different story. Those are the kind of flaws that keep security engineers up at night.
The key takeaway here isn't just "change your password." It's about understanding that your camera is a computer. It runs an operating system, it has network access, and it can be hijacked just like your laptop. The P2P relay technique is particularly nasty because it means that even if you disconnect one camera, the rest of the swarm continues to operate independently.
### Practical Steps to Protect Your Cameras
So, what can you actually do about this? First, check if your device has received a firmware update from Dahua addressing these specific bypasses. If not, consider isolating your cameras on a separate VLAN that has no access to your main network. It's also worth disabling the P2P feature if you don't absolutely need it, as that's the vector that makes remote hijacking so easy.
Finally, stop reusing passwords. It sounds basic, but it's the single most effective defense against credential stuffing attacks. Use a password manager to generate a unique, complex password for every single device you own. The attackers in this campaign got in through the front door because it was unlocked. Lock it.
This incident is a stark reminder that the internet of things is also the internet of threats. Your camera is watching, but so is someone else if you're not careful.
