What happened

• CERT-UA reports confirmed compromises of Dahua IP cameras and DVRs [S1][S2].
• Attackers brute-force predictable device serial numbers through the Easy4IP P2P cloud relay to find devices connected to the cloud [S2].
• They then use weak passwords or the CVE-2021-33044/33045 authentication bypasses to view streams, change configuration and create rogue accounts [S1][S2].
• Hunt.io's related Operation CameraSwarm reportedly compromised more than 14,530 cameras. Reporting also states 1,923 cameras carry a persistent backdoor account (p2pwn / p2password), installed over RPC [S2].
• The backdoor account is reported to survive password changes and factory resets. Removing it without a firmware update is reported to be insufficient [S2].
• The attack also scans for TCP 37777, Dahua's default management and streaming port [S2]. A public GitHub repository is linked in the coverage [S3].

Timeline

Detect

Backdoor account p2pwn · Dahua device account list / audit log (forwarded syslog)

index=* "p2pwn" | stats count min(_time) as first_seen max(_time) as last_seen by host, src

A hit means: A reported CameraSwarm backdoor account name appears on a device. Treat the device as compromised [S2].

DVRIP authentication from 127.0.0.1 · Dahua device audit log

index=* "DVRIP" "127.0.0.1" | stats count min(_time) as first_seen max(_time) as last_seen by host

A hit means: DVRIP logins from a local address are described as a sign of P2P access to the device [S1][S2].

Inbound connections to TCP 37777 · Firewall / network flow logs

index=* dest_port=37777 NOT (src_ip=10.0.0.0/8 OR src_ip=172.16.0.0/12 OR src_ip=192.168.0.0/16) | stats dc(dest_ip) as targets count by src_ip | sort - targets

A hit means: External hosts are reaching or scanning the Dahua management port. This shows exposure and probing, not compromise on its own [S2].

Verify

• Pull the device's account list directly from its web UI or management tool. Compare it against the accounts your camera vendor or integrator documents [S1][S2].
• Check the device audit log around the hit for configuration changes or new accounts [S1].
• Benign look-alike: DVRIP logins from 127.0.0.1 can come from legitimate use of the Easy4IP or DMSS mobile app by staff. Confirm whether anyone authorised uses P2P on that device (inference; not stated in sources).
• Benign look-alike: hits on TCP 37777 from internal VMS or NVR servers are expected. Only external sources are of interest.
• Benign look-alike: internet-wide scanners routinely touch 37777. Correlate with any authentication events on the device itself.

Scope

Affected

• Dahua IP cameras, NVRs and DVRs with outdated firmware vulnerable to CVE-2021-33044/CVE-2021-33045 [S1][S2]
• Dahua devices with Easy4IP P2P enabled [S2]

Only if

• P2P/Easy4IP feature enabled, even if the device is not internet-exposed [S2]
• or device management port TCP 37777 exposed to the internet [S2]
• weak/default passwords or unpatched firmware [S1][S2]

Not affected if

• P2P disabled and device not internet-exposed, with current firmware and strong passwords [S2]

Enumerate

• All Dahua-made devices, including OEM/white-label cameras and recorders, across branches and facilities
• Firmware version per device
• P2P/Easy4IP setting per device
• Device accounts per device, including any named p2pwn
• Firewall/NAT rules exposing TCP 37777 or device web ports
• Network segments where cameras can reach corporate systems

Contain

• Export each device's audit log, account list and configuration before changing anything. Resets and firmware updates may wipe on-device evidence, and that cannot be undone.
• Block inbound TCP 37777 and device management ports from the internet at the perimeter [S2].
• Disable P2P/Easy4IP on every device, or block its cloud relay egress at the firewall [S2].
• Isolate any device with p2pwn or unknown accounts onto a quarantine VLAN with no route to corporate networks.
• Do not rely on a password change or factory reset for containment. The backdoor is reported to survive both [S2].

Eradicate

• Update firmware to a vendor release that fixes CVE-2021-33044/33045. The sources name no fixed version [S1][S2].
• After the firmware update, remove p2pwn and any unknown accounts [S2].
• Set unique strong passwords on all device accounts [S1].
• Reset any recovery codes; reporting says these also survive resets [S2].
• Replace devices that cannot receive a fixed firmware.

Recover

• Before restoring a device to its network, confirm the firmware version, an account list with only known users, P2P disabled and a reviewed configuration.
• Afterwards, alert on new device accounts, configuration changes and DVRIP 127.0.0.1 logins [S1][S2].
• Afterwards, alert on inbound or outbound traffic on TCP 37777 [S2].

Re-enter the loop when

• Dahua publishes or changes an advisory naming fixed firmware versions or more affected models.
• The CERT-UA advisory or Hunt.io report is released with IoCs such as IPs, other account names or relay abuse patterns.
• Reporting shows the camera foothold used to pivot into enterprise networks.
• A p2pwn account or DVRIP 127.0.0.1 login is found on a device thought to have P2P disabled.
• Exploitation is reported against another vendor's P2P relay or OEM rebrands.

Debrief

• Record the device inventory, exposure state, firmware versions and accounts found at detection time.
• Record whether on-device logs existed and how long they were retained.
• Gap: the sources name no fixed firmware versions.
• Gap: the sources give no attacker IPs or infrastructure.
• Gap: the sources give no attribution and no stated objective for the camera access.
• Gap: counts are inconsistent, with 14,530+ cameras compromised and 1,923 carrying the backdoor [S2].

Detection coverage, to check

The model never claims coverage; the automated check fills this table from public sources once it has run.

Open questions

• Which Dahua models and firmware versions fix CVE-2021-33044/33045? None of the sources give this.
• Does the backdoor account really persist through factory reset, and does a firmware update remove it? Reporting is secondhand.
• Why do the figures differ between 14,530+ compromised and 1,923 with the backdoor?
• What are the Easy4IP relay domains or IPs to block or hunt? These are not given.
• What does the GitHub repository [S3] contain, and is it the tool used in these attacks? The sources do not establish its link.
• Is the CERT-UA advisory text available, so a primary source can raise confidence?
• Is there evidence of pivoting from cameras into corporate networks?

Sources

• [S1] https://thehackernews.com/2026/10/attackers-hijack-dahua-ip-cameras-in.html · The Hacker News
• [S2] https://therecord.media/ukraine-cert-ua-warning-chinese-dahua-cameras-hacked · therecord.media
• [S3] https://github.com/jorhelp/Ingram · GitHub

Public OSINT only. AI-generated by the pipeline; structure follows the DAIR model from Dynamic Incident Response (Joshua Wright). Published automatically once it crosses the publish bar.