Over 14,000 Dahua surveillance cameras worldwide were compromised in a recent campaign that allowed attackers to maintain hidden access even after password changes or factory resets. The campaign, lasting 35 days and most active in Russia and Ukraine, exploited unpatched devices to maintain long-term infiltration. Analysts discovered this through recovered tools and malware tied to the operation, revealing how exposed device services offer new, persistent threat vectors.
Exploits Bypass Authentication and Persist After Resets
The attackers first gained entry using two known authentication bypass vulnerabilities (CVE-2021-33044 and CVE-2021-33045) alongside brute-force attacks using weak credential lists. They then deployed a secondary admin account via the remote management interface—this account does not get removed when the primary admin password is changed. Even a factory reset typically fails to eliminate it. Out of the compromised devices, 1,923 were found with this hidden account still active.
Cloud Relay Feature Enables Remote Control—even Behind NAT
Attackers took advantage of Dahua’s cloud relay functionality, which normally allows remote access to cameras behind routers using a serial number. In this case, 89.4% of devices with live serials responded without requiring authentication. The campaign also leveraged offline recovery-code generation, giving attackers the ability to reset passwords without knowing current credentials. This approach adds a deep layer of persistence: simply removing the unauthorized account may not halt access.
Toolset, Indicators, and Scale of Compromise
Researchers retrieved 2,616 files from an open operator directory, revealing tools for credential harvesting, snapshot capture, and large-scale device record export. Names of exploited serial prefixes, exploited ports and domains, default credential pairs, and even payload hashes were identified—some Windows-based malware was included. One binary dubbed xeno.exe was linked to SalatStealer. Targeted assets ranged across thousands of devices scanned globally.
Security teams are advised to audit every user account on Dahua cameras, remove unknown or unauthorized ones, change all credentials, and verify access logs for evidence of compromise. Disabling Peer-to-Peer (P2P) features when unnecessary, limiting management access to internal networks only, and promptly applying available patches for the bypass vulnerabilities are critical steps.
Camera security is no longer a minor IT concern—it now poses serious risk to networks and privacy. Previous incidents have shown that unprotected, exposed IP cameras are increasingly leveraged in campaigns targeting national infrastructure and private networks. For organizations in sensitive sectors, every connected device is a potential entry point.
What this means: Surveillance hardware often installed for safety has become a liability when firmware is outdated or default settings remain exposed. The discovery underscores the complexity of securing connected devices: traditional mitigations like password changes or factory resets may not be enough. Going forward, expect increased scrutiny on IoT and video-device security, with more emphasis on built-in backdoor detection and supply-chain accountability.
