Hunt.io has published an analysis of a campaign it calls Operation CameraSwarm, in which more than 14,530 Dahua devices were compromised between 17 June and 22 July 2026 — a window of 35 days.

The reason the analysis is this detailed is that the operator left their working directory exposed on the internet.

What was in it

407 MB. 2,616 files across 234 subdirectories, containing tooling, logs, shell history and campaign records.

Shell history is the item to sit with. Threat intelligence is normally reconstructed backwards from what an intrusion left behind at the victim; here the researchers had the operator's own typed commands, in order, with their mistakes and retries intact. That is not evidence you usually get.

It is also a useful corrective to how these crews get described. Somebody who compromises fourteen thousand devices in five weeks is competent at the task, and left their notes in a public folder. Both things are true at once, and the second is more common than the mythology allows.

How the cameras were taken

Three routes, in the order you would expect them to work:

  • Credential attacks — default and reused passwords, still the front door on internet-exposed cameras.
  • Two authentication bypass flaws in the devices themselves.
  • A peer-to-peer relay path, which reaches cameras that are not directly exposed at all.

That third one deserves attention if you own any of these. P2P is the convenience feature that lets a phone app reach a camera behind a home router with no port forwarding and no firewall change. It works by having the camera dial out to the vendor's relay — which means the camera is reachable through that relay whether or not anything is open on your network.

283 devices were reached this way. A small share of the total, and it is the share that "I never exposed it to the internet" does not protect against.

Persistence

1,923 of the cameras were given a persistent account during the operation.

A firmware update does not necessarily remove that. An added account survives on configuration that upgrades often preserve, which makes "we patched it" an incomplete answer — the accounts have to be enumerated and removed separately.

Where they are

Confirmed compromises are concentrated in Ukraine and Russia.

That distribution changes what the campaign probably is. A botnet built for DDoS or residential proxy resale takes whatever it can get and skews toward wherever the cheap hardware is. A camera in a war zone is not bandwidth. It is a view of a street, a junction or a building, in a region where that has value to somebody.

Hunt.io does not attribute the campaign, and neither will we. But the geography is a fact about the target selection, and target selection is usually the most honest signal available about intent.

What to do if you own Dahua or EZ-IP cameras

  • Install the vendor fix or newer firmware, from Dahua's own download site rather than a search result.
  • Then check for accounts you did not create. This is the step most people skip, and 1,923 devices in this campaign are the reason it matters.
  • Turn P2P off unless you actually use it. ITRES Labs recommends this specifically. If you reach your cameras over a VPN or on the local network, the relay is buying you nothing and costing you a route.
  • Change the password, and not to another one you use. Credential attacks were the primary path.
  • Do not put a camera on the internet directly. Port-forwarding a camera is the practice that keeps producing these numbers, and it has been an unnecessary practice for years.

What is not established

  • Who ran it. Hunt.io does not attribute, and the exposed files are evidence of activity rather than of identity.
  • What the cameras were used for. Access was established; the purpose is not documented.
  • Whether the two authentication bypasses are patched everywhere. Fix availability is not deployment.
  • The true total. 14,530 is what the operator's own records show, from a directory that was found by accident.