Threats · 4h ago
Ukraine’s CERT-UA reported an unquantified number of cases in which attackers accessed Dahua cameras and video recorders, changed settings and created unauthorized accounts. It did not identify the attackers or say when the incidents occurred. Hunt.io separately reported more than 14,500 Dahua devices compromised earlier in the summer using similar methods, but no link between the campaigns is confirmed.
Easy4IP connects Dahua devices to the company’s cloud by serial number, letting them be found remotely even behind firewalls. Because serial numbers follow predictable patterns, attackers can guess identifiers; they may then try weak or default passwords or exploit authentication-bypass flaws in outdated firmware. A successful intrusion can leave unauthorized accounts and altered settings behind, so restoring the video feed may not remove remote access.
For organizations using Easy4IP, a firewall does not by itself mean cameras are unreachable from outside; the exposure depends on the cloud feature being enabled. The current report gives no victim count, so its reach—and whether it overlaps with Hunt.io’s earlier campaign—remains unknown.
2 sources covering this story
Attackers Hijack Dahua IP Cameras in Ukraine Using P2P Access and Auth Weaknesses
CERT-UA reports Dahua camera compromises via Easy4IP, where predictable serial numbers and weak passwords or firmware flaws enable access.
The Record from Recorded Future
Ukraine warns hackers are exploiting Chinese-made Dahua surveillance cameras
CERT-UA says it has identified cases in which hackers compromised Dahua internet-connected cameras and video recorders, changed their settings and created unauthorized user accounts.
Part of the PlainSec briefing for 2026-10-27