Security researchers have uncovered a large-scale campaign that compromised more than 14,000 internet-connected Dahua security cameras over a 35-day period, planting persistence mechanisms so thorough that even a factory reset often fails to remove them. The operation, uncovered by analysts at Hunt.io, was centered on devices in Ukraine and Russia and combined old, unpatched vulnerabilities with a cloud feature seemingly designed for convenience rather than abuse.

How the Cameras Were Broken Into

The attackers relied on a mix of techniques rather than a single novel exploit. Two known authentication-bypass vulnerabilities, tracked as CVE-2021-33044 and CVE-2021-33045, gave them a way into devices that had never been patched despite the flaws being public for several years. Where those bypasses did not apply, the operators simply brute-forced weak credentials, cycling through defaults like admin:admin, 666666:666666, 888888:888888, and admin:admin123 against exposed camera management interfaces.

The scale of exposure the attackers found was striking: according to logs recovered during the investigation, 89.4 percent of the live device serial numbers they tested returned unauthenticated channels, meaning the vast majority of cameras they probed offered essentially no protection at all against remote access attempts.

A Backdoor That Outlives a Password Reset

What makes this campaign notable is not the initial access technique but what happened afterward. Once inside, the attackers’ toolkit added a separate administrator account through the camera’s own remote management interface. Because this account is stored independently of the device’s main administrator credentials, simply changing the original password does nothing to remove it. Hunt.io identified 1,923 cameras carrying this hidden account, discovered after researchers located an openly exposed operator directory containing more than 2,600 files of campaign tooling.

Even worse, on most of the affected firmware versions a full factory reset, normally considered the last-resort fix for a compromised device, also fails to erase the hidden access. That leaves owners with a device that appears clean after a reset but is, in fact, still fully accessible to the attackers.

Abusing Cloud Recovery as a Backup Plan

The operators added a second layer of persistence by abusing Dahua’s cloud relay functionality, which is designed to let devices behind network address translation be reached remotely using their serial number. By generating offline recovery codes through this feature, the attackers built themselves a fallback method of regaining access via password recovery, without needing to know the device’s current credentials at all. That means even if a defender finds and deletes the hidden account, the attacker may still be able to walk back in through the recovery mechanism unless the underlying firmware vulnerabilities are also patched.

Beyond Surveillance Access

The compromised access was not limited to passive monitoring. The toolkit was capable of harvesting stored credentials, capturing live camera snapshots, and exporting device records in a format built for large-scale administration, suggesting the operation was designed to manage thousands of compromised devices efficiently rather than target them individually. Investigators separately recovered an unrelated Windows payload, identified as the SalatStealer information-stealing malware, on infrastructure connected to the same operators.

The operators’ infrastructure included a primary server at the IP address 154.86[.]119.60 and a secondary host at 185.132[.]53.56 used to serve the Windows payload. No specific threat actor group has been publicly attributed to the campaign.

What Camera Owners Should Do

Because standard remediation steps are insufficient on their own, Hunt.io and other researchers are recommending a more thorough response for anyone operating Dahua cameras, particularly in the affected regions:

• Manually audit every account configured on each camera and remove any account that was not explicitly created by an authorized administrator
• Rotate credentials on both cameras and any connected network video recorders, rather than assuming a single password change is sufficient
• Apply vendor firmware updates that patch CVE-2021-33044 and CVE-2021-33045, which is also necessary to prevent new recovery codes from being generated and to invalidate any codes issued earlier
• Disable peer-to-peer and cloud relay features on cameras that do not need remote access through those channels
• Restrict access to camera management interfaces to trusted internal networks rather than exposing them directly to the internet
• Watch for the specific persistent-account credential pair identified in this campaign, p2pwn and p2password, as a direct indicator of compromise

The episode is a reminder that Internet of Things devices left running years-old firmware remain a soft target, and that vendor-provided convenience features like cloud recovery can just as easily become a second front door for attackers if they are not locked down alongside the primary login.