Threat Actor Hacks 14,000 IP Cameras in Ukraine and Russia

Operation CameraSwarm exploited a combination of three known Dahua vulnerabilities alongside brute-force attacks to implant persistent backdoor accounts on over 14,000 IP cameras across Ukraine and Russia. The root failures are threefold: unpatched firmware left cameras exposed to CVEs disclosed as far back as 2021, weak or default credential policies allowed brute-force attacks to succeed, and insecure cloud relay features enabled attackers to bypass NAT protections entirely. This matters because internet-facing surveillance devices are critical infrastructure — their compromise can enable mass espionage, physical security breaches, and persistent footholds in sensitive networks. The fact that attacker infrastructure was staged a year in advance underscores that this was a deliberate, long-term campaign that proactive controls could have disrupted.