Ukraine’s CERT-UA says attackers are taking over Dahua cameras and recorders by guessing serial numbers and connecting through the vendor’s Easy4IP cloud relay, which means a firewall alone does not protect them. UK organisations with Dahua kit that has P2P turned on should assume the same attack path works against them.
What happened
Late last week, Ukraine’s national computer emergency response team, CERT-UA, which sits within the State Service of Special Communications and Information Protection (SSSCIP), warned that intruders had broken into Dahua IP cameras, network video recorders and DVRs. The agency confirmed cases where attackers gained access to live video, changed device configuration and added accounts of their own. The Record reported the alert on 26 October and The Hacker News followed on 27 October.
CERT-UA has not said how many devices were hit, whose they were, when the intrusions began or who was responsible. Hunt.io told The Record that the techniques closely match its Operation CameraSwarm findings, while stressing there is no evidence tying the two to the same operator.
The wider context makes this more than a nuisance story. In July 2026 the Dutch intelligence services, AIVD and MIVD, said at least one Russian intelligence service was systematically using compromised internet-connected cameras for espionage across the Netherlands, other EU and NATO states, and Ukraine. The Dutch bulletin, as quoted by The Hacker News, describes image recognition used to spot military vehicles and cargo.
The technical picture
The interesting part is how the attackers reach the device in the first place. Easy4IP is Dahua’s peer-to-peer service: a user scans a QR code or types in the hardware serial number, and the vendor’s cloud relay brokers a connection to a camera sitting behind NAT. No port forwarding is needed. That convenience is the flaw.
CERT-UA says Dahua serial numbers are far from random. The first ten characters are a model prefix shared by every unit in a product family, and the last five are a hexadecimal counter that rises almost one by one. An attacker who knows a single valid serial can work through its neighbours, and the agency says this can be done at scale without running into rate limits or lockouts. In CERT-UA’s words, the belief that nobody knows a serial “is not a reason to consider the device secure.”
Finding the device only gets the attacker to the login prompt. To get past it, they rely on weak or default passwords, or on two Dahua authentication bypasses from 2021, CVE-2021-33044 and CVE-2021-33045, which still work on unpatched firmware. Hunt.io’s CameraSwarm research shows what an operator can do with this. One actor compromised more than 14,530 Dahua devices between 17 June and 22 July 2026, brute-forcing credentials over TCP port 37777 and chaining the two bypasses. It planted a persistent extra account on 1,923 cameras and reached 283 through the cloud relay using only the serial number. Because that account lives apart from the admin password, Hunt.io found it persisted through credential changes and, on most firmware versions, even a reset to factory defaults. The operator also had tooling to derive recovery codes from serials, making access transferable.
CERT-UA’s indicators are worth giving to whoever looks after your CCTV: unfamiliar user accounts, configuration changes nobody authorised, and audit log entries showing authentication over Dahua’s native DVRIP protocol from 127.0.0.1. That loopback address is the giveaway, because relayed P2P sessions appear to originate locally.
Why it matters for UK organisations
Dahua equipment is common in British car parks, warehouses, schools and shops, usually fitted by installers rather than IT and set up through the vendor’s app, which needs P2P to work. The result is a device on no asset register, outside vulnerability scanning and unpatched, yet reachable by anyone who can guess its serial.
The government already treats these cameras as a risk on its own estate. In November 2022, Oliver Dowden, then Chancellor of the Duchy of Lancaster, ordered departments to stop installing surveillance kit from firms bound by Beijing’s intelligence legislation at sensitive sites, and to keep existing units off core networks. The National Protective Security Authority notes the decision may affect organisations outside government too. That was a supply chain judgement; CERT-UA’s alert adds a more immediate one.
There is also a direct UK link in the reconnaissance data. In August, Hunt.io’s research into a Russian-speaking operator who compromised 58 Ukrainian cameras led to a second, separately run server whose router discovery queries covered 15 European countries, the UK among them. Hunt.io found no other mention of those countries, and its camera targeting was Ukraine-only. Still, it shows proxy-hunting operators already look for British devices.
Expert view
When we scope an internal test, CCTV is usually listed as out of scope or forgotten. Then we find an NVR on the same flat network as the finance team, still on its installer password. In my experience, physical security systems are one of the most reliable footholds an attacker can find in a mid-sized organisation, because nobody owns them.
What makes the P2P angle worth taking seriously is that it removes the firewall from the picture. Red teams have long treated outbound cloud brokering as a blind spot: the device makes the outbound connection, so perimeter rules allow it. Predictable identifiers turn that into an enumeration problem, and enumeration is cheap. I would not overstate attribution: CERT-UA names no actor. But state services clearly value camera footage, and criminals value cameras as relays.
The survivable backdoor account is what should worry incident responders most. If it outlives a reset, a reset is not remediation; Hunt.io says firmware must be updated too.
What to do now
- Find your cameras. Build an inventory of every Dahua (and other) IP camera, NVR and DVR, including those installed and managed by contractors. This is the asset management basis of Cyber Essentials, and these devices count.
- Turn off P2P/Easy4IP where it is not essential. CERT-UA and the NCSC both advise disabling remote viewing that is not needed. If remote access is genuinely required, put it behind a VPN you control.
- Update firmware. Prioritise anything vulnerable to CVE-2021-33044 and CVE-2021-33045. This maps to the Cyber Essentials security update management control.
- Audit accounts and logs. Look for unknown users, unexplained configuration changes and DVRIP logins from 127.0.0.1. Treat any hit as a compromise: update firmware, then rebuild accounts and rotate credentials.
- Replace default and weak passwords with unique, strong credentials, in line with Cyber Essentials user access control and the NCSC’s smart camera guidance.
- Segment. Put cameras on their own VLAN with no route to corporate systems, limit outbound traffic, and disable UPnP and port forwarding on routers (Cyber Essentials firewalls and secure configuration).
- Review procurement. Check NPSA guidance on surveillance equipment, especially for sensitive or critical national infrastructure sites.
Bottom line
CERT-UA’s alert is not about a new zero-day. Attackers are combining predictable serial numbers, a cloud relay that gets past perimeter controls, and five-year-old authentication bugs that should have been patched long ago. UK organisations do not need to be in a war zone to be exposed: they only need a Dahua camera with P2P switched on and nobody looking after it. Find them, switch the relay off and patch.
Sources
- The Record: Ukraine warns hackers are exploiting Chinese-made Dahua surveillance cameras
- The Hacker News: Attackers Hijack Dahua IP Cameras in Ukraine Using P2P Access and Auth Weaknesses
- Hunt.io: Operation CameraSwarm
- Hunt.io: Russian-speaking operator’s Ukrainian camera toolkit
- AIVD: Cybersecurity advisory – Russian state actors are compromising IP cameras
- NCSC: ‘Smart’ security cameras: using them safely in your home
- NPSA: Security update – surveillance equipment
- IFSEC Insider: UK government departments ordered to stop installing Chinese video surveillance equipment
