Inside Operation CameraSwarm: How One Actor Took Over 14,000 Dahua Cameras
Brief
An exposed operator directory reveals how one actor compromised 14,000+ Dahua cameras across Ukraine and Russia, no password needed for most.
A researcher discovered an exposed directory containing the tools of an attacker who compromised more than 14,000 Dahua cameras between June 17 and July 22, 2026, mainly in Ukraine and Russia. Hunt. io reconstructed the operation, named Operation CameraSwarm, from the leaked files and telemetry.
The find started with a mistake. On 23 July, Hunt. io’s AttackCapture system crawled a server at 154. 86[. ]119. 60 and pulled down 2,616 files across 234 subdirectories, 407 MB in total, from an HTTP directory the operator had left wide open. That single slip handed researchers the operator’s scanning engine, exploit chains, exfiltration bot, and a Windows stealer staged on the same box.