CERT-UA: Hackers Compromise Dahua Cameras in Ukraine via Easy4IP P2P
CERT-UA has recorded cases of compromised Dahua IP cameras and DVRs, with attackers accessing video streams, changing device settings and creating unauthorized accounts. The intruders combine Easy4IP P2P remote access, weak or default passwords and authentication flaws in outdated firmware, including CVE-2021-33044 and CVE-2021-33045. Hunt.io reported an earlier campaign with more than 14,500 compromised Dahua devices and similar methods; a firmware update is required, as rogue accounts survive password changes and, on most versions, factory resets.
What happened
CERT-UA, Ukraine's emergency response team, warned that hackers compromised internet-connected Dahua IP cameras and video recorders: they accessed video streams, changed device settings and created unauthorized accounts. The agency did not say how many devices were affected, when the attacks occurred or who was responsible. Hunt.io reported an earlier summer campaign with more than 14,500 compromised Dahua devices, concentrated in Ukraine and Russia.
Why it matters
Cameras with Easy4IP remote access enabled are exposed even behind firewalls, because the cloud connection relies on predictable serial numbers. Dahua equipment is used in Ukraine by government institutions and military units, amid concerns that Russian intelligence could exploit surveillance cameras. Rogue accounts and recovery codes can survive password changes and, on most firmware versions, factory resets.
What to do
Inventory exposed Dahua cameras and DVRs, disable Easy4IP if remote access is unnecessary, replace default passwords and update firmware. Audit device user accounts, as removing malicious accounts without a firmware update is not enough.
For the technical team
- Affected
- Câmeras e gravadores Dahua conectados à internet, com acesso P2P Easy4IP (casos identificados pelo CERT-UA) · Internet-connected Dahua IP cameras and DVRs with Easy4IP enabled. CVE-2021-33044 and CVE-2021-33045, disclosed in 2021, affect certain Dahua cameras and video recorders.
- Exploitation
- Real cases recorded by CERT-UA, with video stream access, configuration changes and third-party account creation. Hunt.io reported in August that more than 14,500 Dahua devices were compromised earlier in the summer, concentrated in Ukraine and Russia; similar methods, with no evidence of a link. The servers from that earlier campaign remain online and no new copies of the toolkit have appeared since July.
- Fix
- Update device firmware. Change default passwords and disable Easy4IP if cloud remote access is unnecessary. Malicious accounts and recovery codes survive password changes and, on most firmware versions, factory resets; removing the accounts without updating firmware is not enough.
- Vector
- Easy4IP P2P feature: connects cameras and DVRs to Dahua's cloud by serial number, even behind firewalls or without direct internet access; serial numbers follow predictable patterns and can be guessed at scale. Once a device is identified, attackers guess weak or default passwords or exploit authentication bypass flaws in outdated firmware.
- More details
- CERT-UA did not say how many devices were compromised, when the attacks occurred or who was responsible. Hunt.io told Recorded Future News that the methods described by CERT-UA closely match the earlier campaign, with no proof of the same hackers. Ukrainian context: the SBU told The Wall Street Journal it had identified and secured about 40,000 cameras since Russia's 2022 full-scale invasion; in January 2024, the SBU said Russian intelligence services hacked two cameras in Kyiv to monitor air defense activity and stream footage to YouTube. A 2024 RFE/RL investigation found about 24,000 Dahua and Hikvision cameras in Ukrainian municipal surveillance systems. Ukrainian public procurement records cited in the report show government institutions and military units still purchasing Dahua equipment in 2026. Dahua faces US restrictions: a 2018 ban on federal agency procurement and a 2019 trade blacklist.
Timeline
CERT-UA details that attackers access the video stream, change device configuration and create third-party accounts, exploiting P2P access and authentication weaknesses.
CERT-UA says attackers watched video feeds, changed device settings and created rogue accounts, combining Easy4IP P2P access with weak passwords or authentication bypass flaws.
CERT-UA reports real cases of compromised Dahua cameras with unauthorized accounts created.
Sources 3 sources
- Ukraine warns hackers are exploiting Chinese-made Dahua surveillance cameras The Record
- @TheHackersNews @TheHackersNews
- Attackers Hijack Dahua IP Cameras in Ukraine Using P2P Access and Auth Weaknesses The Hacker News
