Bản viết lại dựa trên nguồn: https://www.securityweek.com/threat-actor-hacks-14000-ip-cameras-in-ukraine-and-russia/
Threat Actor Hacks 14,000 IP Cameras in Ukraine and Russia – SecurityWeek SECURITYWEEK NETWORK: Cybersecurity News Webcasts Virtual Events Podcast ICS: ICS Cybersecurity Conference Malware & Threats Cyberwarfare Cybercrime Data Breaches Fraud & Identity Theft Nation-State Ransomware Vulnerabilities Security Operations Threat Intelligence Incident Response Tracking & Law Enforcement Security Architecture Application Security Cloud Security Endpoint Security Identity & Access IoT Security Mobile & Wireless Network Security Risk Management Cyber Insurance Data Protection Privacy & Compliance Supply Chain Security CISO Strategy Cyber Insurance CISO Conversations CISO Forum ICS/OT Industrial Cybersecurity ICS Cybersecurity Conference Funding/M&A Cybersecurity Funding M&A Tracker Cyber AI Cybersecurity News Webcasts Virtual Events Podcast ICS Cybersecurity Conference Connect with us Hi, what are you looking for? SecurityWeek Malware & Threats Cyberwarfare Cybercrime Data Breaches Fraud & Identity Theft Nation-State Ransomware Vulnerabilities Security Operations Threat Intelligence Incident Response Tracking & Law Enforcement Security Architecture Application Security Cloud Security Endpoint Security Identity & Access IoT Security Mobile & Wireless Network Security Risk Management Cyber Insurance Data Protection Privacy & Compliance Supply Chain Security CISO Strategy Cyber Insurance CISO Conversations CISO Forum ICS/OT Industrial Cybersecurity ICS Cybersecurity Conference Funding/M&A Cybersecurity Funding M&A Tracker Cyber AI IoT Security Threat Actor Hacks 14,000 IP Cameras in Ukraine and Russia Operation CameraSwarm targeted Dahua cameras across multiple countries, focusing on Russian and CIS telecom netblocks. By Ionut Arghire | August 20, 2026 (9:16 AM ET) Flipboard Reddit Whatsapp Whatsapp Email A threat actor has conducted a mass-hacking campaign against Dahua IP cameras, compromising over 14,000 of them across Ukraine and Russia, Hunt.io reports. The activity, referred to as Operation CameraSwarm, occurred between June 17 and July 22. It initially involved global scanning across Russian, Mexican, and Vietnamese ISP ranges, but later focused on Russian and CIS telecom netblocks. Hunt.io says it gained access to the threat actor’s servers, where it found 2,616 files across 234 subdirectories, or approximately 407 MB of data, left in an open HTTP directory that the hackers exposed themselves. Analysis of the data revealed the compromise of over 14,530 devices within the 35-day-long campaign. A brute-force engine was used to target 12,324 unique addresses. The threat actor deployed a persistent backdoor account on 1,923 cameras over Remote Procedure Call (RPC). The account uses the p2pwn/p2password username and password pair. “It is stored independently of the admin password and survives a password change and, on most firmware, a factory reset,” Hunt.io says.Advertisement. Scroll to continue reading. For credential brute-forcing, the threat actor used a publicly available asyncio framework. Additionally, they relied on a compiled Go binary for authentication bypass, chaining three vulnerabilities, including the CVE-2021-33044 and CVE-2021-33045 bypasses, and CVE-20244-39943 to deploy the backdoor account. “CVE-2021-33044 exploits unconditional trust in clients identifying as NetKeyboard hardware controllers: when clientType is NetKeyboard, the password field is never evaluated. CVE-2021-33045 exploits the firmware reading the claimed source address from the request body rather than the TCP connection,” Hunt.io says. The bypasses return a full administrator session unauthenticated, and the binary drops the p2pwn / p2password account over RPC. In some instances, the attackers abused Dahua’s cloud relay to reach cameras behind NATs, using only their serial numbers. Hunt.io discovered that the threat actor set up the infrastructure used in the campaign at least one year before the attacks, and that its toolkit contains both their own code and modified code from at least four other developers. “We assess with moderate confidence that the toolkit was built to hand access to a third party, based on the transferable recovery-code design and the enterprise-format export pipeline. That is narrower than a confirmed commercial operation, which the evidence does not support,” Hunt.io says. The report does not establish the operator’s ultimate motivation or intended use of the compromised cameras. Related: Hackers Using AI to Target Siemens PLCs in Critical US Sectors Related: Cl0p Ransomware Group Names Over 40 Victims of PTC Windchill Campaign Related: Fortune 500 Companies Hit in Azure Data Theft Campaign Related: Stealthy ‘City-Forum’ Attacks Target Salesforce and ServiceNow With Custom Toolset Written By Ionut Arghire Ionut Arghire is an international correspondent for SecurityWeek. Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights. More from Ionut Arghire Microsoft Patches Exploited Entra ID VulnerabilityCISA Urges Immediate Patching of Exploited TrueConf VulnerabilitiesAtlassian, Splunk Patch Dozens of Critical, High-Severity VulnerabilitiesMLflow Vulnerability Exploited for Cloud Credential TheftCisco Patches Critical Crosswork, Secure Workload VulnerabilitiesExploitation Expected for Critical Authentication Bypass Patched in Citrix NetScalerCritical GitLab Flaw Exploited Shortly After DisclosurePrevalent AI Raises $22 Million to Expand Data Fabric Platform Latest News Banking Trojans Manic, Grandoreiro, ToxicPanda 2.0 in the SpotlightFormer NSA Director Paul Nakasone Launches National Security Advisory FirmIn Other News: Zombie Card Attack, T-Mobile Cut Cable to Stop Hackers, GitHub Denies AI Caused BugEncrypted Prompts Bypass AI Safety Guardrails in Grok and GeminiNew Phishing Toolkit Uses Passkeys to Maintain Access After Password ResetsCritical Isolated-vm Vulnerability Leads to RCE on HostRust Supply Chain Attack Linked to North Korean HackersContractors’ CMMC Confidence Rises as Ability to Prove It Falls Behind Trending Daily Briefing NewsletterSubscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Webinar: Rethinking Cyber Defense for AI-Speed Attacks August 18, 2026 Join this live webinar as we explore if detection-first security operations can keep pace with AI, or if it’s time to rethink prevention as the strongest default. Register Virtual Event: CodeSecCon 2026 August 19, 2026 CodeSecCon bridges the gap between dev and security. Discover best practices for secure coding, innovative risk-reduction tools, and safe AI integration to cultivate a true DevSecOps culture. Safely secure your apps! Register People on the MoveVensure Employer Solutions appointed Michael Lockhart as Chief Information Security Officer.WISeKey has appointed Alexander Hirsch as Group Chief Marketing Officer.UltraViolet Cyber has named Andrew Park Chief Information Security Officer.More People On The MoveExpert Insights The AI Governance Gap Is a Leadership Problem: Waiting Won’t Close It Organizations are rushing to implement AI without fully grasping where its legal protections begin and end. (Steve Durbin) Rethinking AI Security: Why CASB and DLP Need an Interaction-Aware Layer Build your strategy around answering these questions to ensure employees use AI productively while keeping sensitive data, IP, and agent behavior within the boundaries set for safe AI use. (Etay Maor) Timeless Compliance: Why Better Questions Beat Bigger Frameworks The best compliance programs aren't the biggest ones. They're the ones built on a short list of questions that can actually be answered, and that still hold true when the models change. (Matt Honea) Is Patching Dead? Vulnerability Management in the Post-Mythos Era You cannot out-patch a machine that writes a working exploit from a vulnerability description in twenty hours. Stop trying to optimize a game you cannot win. (Danelle Au) When Identity Verification Fails: Lessons from a Real-World SIM Swap and Near Account Takeover Identity confidence changes throughout every interaction and should be reassessed continuously as new risk signals emerge. (Torsten George) Flipboard Reddit Whatsapp Whatsapp Email Popular Topics Cybersecurity News Industrial Cybersecurity Security Community Virtual Cybersecurity Events Webcast Library CISO Forum AI Risk Summit ICS Cybersecurity Conference Cybersecurity Newsletters Stay Intouch Cyber Weapon Discussion Group RSS Feed Security Intelligence Group Follow SecurityWeek on LinkedIn About SecurityWeek Advertising Event Sponsorships Writing Opportunities Feedback/Contact Us Privacy Policy News Tips Got a confidential news tip? We want to hear from you. Submit Tip Advertising Reach a large audience of enterprise cybersecurity professionals Contact Us Daily Briefing Newsletter Subscribe to the SecurityWeek Daily Briefing and get the latest content delivered to your inbox. Privacy Policy Copyright © 2026 SecurityWeek ®, a Wired Business Media Publication. All Rights Reserved. Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing to stay informed on the latest cybersecurity news, threats, and expert insights. Unsubscribe at any time. Close