Dahua Cameras Hijacked via Predictable Serial Numbers in Ukraine

Ukraine’s CERT-UA warned of attackers gaining unauthorized access to Dahua IP cameras and DVRs through the Easy4IP P2P platform, which allows remote monitoring via QR code or hardware serial number. Attackers modified configurations, accessed video streams, and created unauthorized accounts on compromised devices.

Dahua serial numbers follow a predictable structure: a 10-character model prefix identical across device families and a 5-character hexadecimal counter incremented sequentially. This allows attackers to brute-force serials at scale without triggering rate limits and identify cloud-connected devices. Combined with weak passwords and authentication bypass flaws in outdated firmware versions (CVE-2021-33044 and CVE-2021-33045), all devices with active P2P functionality remain vulnerable regardless of internet exposure.

Hunt.io disclosed two attack campaigns exploiting these weaknesses. A Russian-speaking operator compromised 58 internet-exposed cameras in Ukraine using known vulnerabilities in Dahua and Hikvision products, while scanning routers and cameras from TP-Link and MikroTik across 15 European countries. A second campaign, Operation CameraSwarm, compromised over 14,530 Dahua cameras between June 17 and July 22, 2026, deploying a persistent backdoor account on nearly 2,000 devices that survives password changes and factory resets. Dutch intelligence agencies warned that Russian actors are systematically compromising IP cameras across the EU, NATO states, and Ukraine for digital espionage, using image recognition to identify military vehicles, transport routes, and weapons deliveries.