Hackers Compromised 14,500+ Dahua Devices Using Credential Attacks, Auth Bypasses, and P2P

Researchers at Hunt.io have revealed a campaign that compromised over 14,530 Dahua devices between June 17 and July 22, 2026. The campaign, known as Operation CameraSwarm, utilized credential attacks, authentication bypasses, and a peer-to-peer relay technique to gain access to the devices. The researchers were able to reconstruct the activity from an exposed working directory containing over 2,600 files. The directory, which was 407 MB in size, provided insight into the scope of the campaign. The compromised devices were accessed using a combination of exploits, including two authentication-bypass flaws. The researchers analyzed the exposed directory to understand the methods used in the campaign.