Ukraina Kompyuter Favqulodda Vaziyatlarga Javob Guruhi (CERT-UA) Dahua tomonidan ishlab chiqarilgan videokuzatuv tizimlariga ruxsatsiz masofaviy kirish haqida ogohlantirish e'lon qildi.
"IP kameralar va DVR'lar videostrimga kirish, qurilma konfiguratsiyasini o'zgartirish va uchinchi tomon hisoblarini yaratish bilan bog'liq buzilish holatlari qayd etildi", — deb aytildi Ukraina Davlat Maxsus Aloqa Xizmati (SSSCIP) o'tgan hafta e'lon qilgan ogohlantirishda.
Hujumlardagi asosiy dastlabki kirish vektori Easy4IP orqali amalga oshiriladi — bu peer-to-peer (P2P) platforma bo'lib, foydalanuvchilarga Dahua IP kameralarini, NVR'larini va DVR'larini smartfon ilovasi yoki veb-brauzer orqali QR-kodni skanerlash yoki apparat seriya raqamini (SN) kiritish orqali uy yoki kichik biznesni masofadan kuzatish imkonini beradi.
Agentlik seriya raqamlarining bashorat qilinadigan tuzilishga ega ekanligini ogohlantirdi: ular bir xil qurilma oilasining barcha birliklari uchun bir xil bo'lgan 10 belgili model prefiksini va deyarli ketma-ket oshib boradigan besh belgili o'n oltilik sanoqchini (masalan, 7K01F36PCA003E8) o'z ichiga oladi.
Bu, o'z navbatida, hujumchilarga ularni keng miqyosda brute-force hujumi orqali taxmin qilish va ular tezlik cheklovlari yoki blokirovkalarga duch kelmasdan bulutga ulanganligini aniqlash imkonini beradi. Natijada, faol P2P funksiyasiga ega bo'lgan barcha qurilmalar, hatto ular to'g'ridan-to'g'ri internet orqali kirish mumkin bo'lmasa ham, xavf ostida qoladi.
"Seriya raqami hech kimga ma'lum emas degan taxmin qurilmani xavfsiz deb hisoblash uchun sabab emas", — dedi CERT-UA.
Autentifikatsiya to'siqlari zaif yoki ma'lum parollarni ishlatish yoki eskirgan dasturiy ta'minot versiyalaridagi autentifikatsiyani chetlab o'tish zaifliklarini, masalan CVE-2021-33044 va CVE-2021-33045, ekspluatatsiya qilish orqali yengib o'tiladi. CERT-UA faoliyat bilan bog'liq quyidagi buzilish ko'rsatkichlarini e'lon qildi:
- Noma'lum hisoblar mavjudligi
- Ruxsatsiz konfiguratsiya o'zgarishlari
- Ishlab chiqaruvchining mahalliy protokoli (DVRIP) yordamida va mahalliy manzildan (127.0.0.1) autentifikatsiya hodisalarini o'z ichiga olgan audit jurnallari — bu P2P kirish belgisi.
Tahdidga qarshi turish uchun, agar talab qilinmasa P2P funksiyasini o'chirish, ularni to'g'ridan-to'g'ri internetga ochiq qoldirmaslik va dasturiy ta'minotni yangilab turish tavsiya etiladi.
Agentlik kim nishonga olingani, bu infektsiyalar qachon sodir bo'lgani, qancha qurilma infektsiyalanganligi yoki faoliyat uchun kim javobgar ekanligini oshkor qilmadi. Biroq, natijalar Hunt.io tomonidan Ukraina va Rossiyadagi IP kameralarni nishonga olgan ikki faoliyat klasteri sifatida e'lon qilingan natijalar bilan o'xshashliklarga ega.
Kampaniyalardan biri, rus tilida so'zlashuvchi operatorga tegishli deb hisoblangan, Ukrainadagi internetga ochiq kameralarni ma'lum Dahua va Hikvision zaifliklari yordamida nishonga oldi va natijada 58 ta qurilmani buzdi. Faoliyat ommaviy veb-kamera zaiflik skaneri Ingramni integratsiya qilish orqali quyidagi kamchiliklarni ekspluatatsiya qilishni o'z ichiga oldi:
- CVE-2017-7921 — Hikvision'dagi autentifikatsiyani chetlab o'tish zaifligi
- CVE-2020-25078 — D-Link'dagi ma'lumotlarni oshkor qilish zaifligi
- CVE-2020-25169 — Reolink'dagi autentifikatsiyasiz ma'lumot oshkor qilish zaifligi
- CVE-2021-33044 / CVE-2021-33045 — Dahua'dagi parolsiz kirish imkonini beradigan autentifikatsiyani chetlab o'tish zaifliklari
- CVE-2021-36260 — Hikvision'dagi autentifikatsiyasiz masofaviy kod bajarish zaifligi.
Shu bilan birga, tahdid aktori TP-Link va MikroTik routerlari va kameralarini CVE-2024-53375 va CVE-2024-57049 kabi zaifliklar yordamida 15 ta Yevropa mamlakatida, jumladan Ukraina, Polsha, Ruminiya, Moldova, Vengriya, Chexiya, Slovakiya, Bolgariya, Germaniya, Fransiya, Niderlandiya, Italiya, Ispaniya, Buyuk Britaniya va Avstriyada skanerlash va ekspluatatsiya qilish bilan ham shug'ullangani aytiladi.
Operation CameraSwarm deb nomlangan ikkinchi kampaniya, yagona tahdid aktoriga tegishli deb hisoblanadi va 2026-yil 17-iyun va 22-iyul oralig'ida 14 530 dan ortiq Dahua IP kamerasini buzgan deb ishoniladi. Bu kombinatsiyalangan ma'lumotlar brute-force hujumlari va CVE-2021-33044–CVE-2021-33045 zanjirini ekspluatatsiya qilish yordamida amalga oshirildi.
Hujum Dahua tomonidan ishlatiladigan standart xususiy boshqaruv va videostrim porti bo'lgan TCP port 37777 ni skanerlash bilan boshlanadi, so'ngra seriya raqamlarini yig'ish, yuqorida aytib o'tilgan ikki ekspluatatsiya usulini qo'llash orqali ushbu qurilmalarga kirish va deyarli 2 000 ta kamerada parol o'zgartirish va zavod sozlamalariga qaytarishdan omon qoladigan doimiy orqa eshik hisobini ("p2pwn / p2password") joylashtirish bilan davom etadi.
"1 923 ta kamerada doimiy orqa eshik hisobi (p2pwn / p2password) mavjud, u RPC orqali har qanday chetlab o'tishdan so'ng o'rnatilgan", — deb ta'kidladi Hunt.io o'sha paytda. "U admin parolidan mustaqil ravishda saqlanadi va parol o'zgartirishdan, shuningdek, ko'pchilik dasturiy ta'minotlarda zavod sozlamalariga qaytarishdan omon qoladi. 283 ta kameraga faqat seriya raqami orqali Dahua bulut relayi yordamida, qurilma manzili va ko'p hollarda ma'lumotlarsiz erishilgan."
Ba'zi hollarda hujumchilar NAT ortidagi kameralarga faqat ularning seriya raqamlari yordamida Dahua bulut relayini suiiste'mol qilish orqali erishgani aniqlangan.
Joriy yil boshida Niderlandiya razvedka agentliklari rus aktorlari tizimli raqamli josuslik operatsiyalarini o'tkazish va harbiy razvedka olish maqsadida Yevropa Ittifoqi, NATO davlatlari va Ukrainadagi IP kameralarni buzayotgani haqida ogohlantirdi.
"Bu aktor harbiy transport vositalari va ular tashiyotgan harbiy yuklarni maqsadli qidirish uchun tasvirni tanib olish dasturi orqali tasvirlarni avtomatlashtirilgan tahlil qiladi", — deb aytildi 2026-yil iyul oyidagi byulletenida.
"Bu aktorga, jumladan, Yevropa Ittifoqi va NATO harbiy transport yo'nalishlari, Ukrainaga qurol yetkazib berish va Ukraina harbiy xodimlarining joylashuvi kabi tegishli harbiy ma'lumotlarni taqdim etadi. Ukrainadagi IP kameralardan olingan ma'lumotlar Ukraina harbiy xodimlarini yo'q qilish va ularning harbiy materiallarini yo'q qilishga urinishlarda ishlatiladi."
The Computer Emergency Response Team of Ukraine (CERT-UA) has issued an alert warning of unauthorized remote access to video surveillance systems manufactured by Dahua.
"Cases of compromising IP cameras and DVRs with access to the video stream, changing the device configuration and creating third-party accounts have been recorded," the State Special Communications Service of Ukraine (SSSCIP) said in an alert issued last week.
The primary initial access vector used in the attacks is via Easy4IP, a peer-to-peer (P2P) platform that allows users to remotely monitor homes or small businesses by connecting their Dahua IP cameras, NVRs, and DVRs via a smartphone app or web browser by scanning a QR code or entering the hardware Serial Number (SN).
The agency has warned that the serial numbers have a predictable structure containing a 10-character model prefix that's identical for all units of the same device family and a five-character hexadecimal counter that's incremented almost sequentially (e.g., 7K01F36PCA003E8).
This, in turn, allows attackers to guess them at scale through a brute-force attack and identify if they are connected to the cloud without hitting rate limits or lockouts. As a result, all devices with active P2P functionality are at risk even if they cannot be accessed directly via the internet.
"The assumption that the serial number is unknown to anyone is not a reason to consider the device secure," CERT-UA said.
Authentication barriers are overcome by leveraging weak or known passwords, or by exploiting authentication bypass vulnerabilities in outdated firmware versions, such as CVE-2021-33044 and CVE-2021-33045. CERT-UA has shared the following indicators of compromise associated with the activity -
- Presence of unknown accounts
- Unauthorized configuration changes
- Audit logs containing authentication events using the manufacturer's native protocol (DVRIP) and from a local address (127.0.0.1), a sign of P2P access.
To counter the threat, it's advised to disable the P2P feature if not required, avoid exposing them directly to the internet, and keep the software up-to-date.
The agency has not disclosed who was targeted, when these infections occurred, how many devices had been infected, or who was responsible for the activity. However, the findings share similarities with two clusters of activity that Hunt.io disclosed as targeting IP cameras in Ukraine and Russia.
One of the campaigns, attributed to a Russian-speaking operator, singled out internet-exposed cameras in Ukraine using known Dahua and Hikvision vulnerabilities, ultimately compromising 58 devices. The activity involved the exploitation of the following flaws by integrating Ingram, a publicly available webcam vulnerability scanner -
- CVE-2017-7921 - An authentication bypass vulnerability in Hikvision
- CVE-2020-25078 - A credential disclosure vulnerability in D-Link
- CVE-2020-25169 - An unauthenticated information disclosure vulnerability in Reolink
- CVE-2021-33044 / CVE-2021-33045 - Authentication bypass vulnerabilities in Dahua that allow passwordless login
- CVE-2021-36260 - An unauthenticated remote code execution vulnerability in Hikvision.
In parallel, the threat actor is also said to have undertaken scanning and exploitation of TP-Link and MikroTik routers and cameras using vulnerabilities like CVE-2024-53375 and CVE-2024-57049 across 15 European countries, including Ukraine, Poland, Romania, Moldova, Hungary, Czechia, Slovakia, Bulgaria, Germany, France, the Netherlands, Italy, Spain, the U.K., and Austria.
The second campaign, codenamed Operation CameraSwarm and attributed to a lone threat actor, is believed to have compromised over 14,530 Dahua IP cameras between June 17 and July 22, 2026, using a combination of credential brute-force attacks and the exploitation of the CVE-2021-33044-CVE-2021-33045 chain.
The attack scans for TCP port 37777, which is the default proprietary management and video streaming port used by Dahua, followed by collecting serial numbers, breaking into those devices by employing the aforementioned two exploitation methods, and then deploying a persistent backdoor account ("p2pwn / p2password") on nearly 2,000 cameras in a manner that can survive password change and a factory reset.
"1,923 cameras carry a persistent backdoor account (p2pwn / p2password), installed over RPC after either bypass," Hunt.io noted at the time. "It is stored independently of the admin password and survives a password change and, on most firmware, a factory reset. 283 cameras were reached by serial number alone through Dahua's cloud relay, with no device address and, in most cases, no credentials."
In some instances, the attackers have been found to abuse Dahua's cloud relay to reach cameras behind NATs using only their serial numbers.
Earlier this year, Dutch intelligence agencies warned that Russian actors are compromising IP cameras across the E.U., NATO states, and Ukraine to conduct systematic digital espionage operations and acquire military intelligence.
"This actor performs automated analysis of imagery through image recognition software to conduct targeted searches for military vehicles and the military cargo they are transporting," the July 2026 bulletin said.
"This provides the actor with, among other things, relevant military data, such as E.U. and NATO military transport routes, weapon deliveries to Ukraine, and the locations of Ukrainian military personnel. The information from IP cameras in Ukraine is used in attempts to neutralize Ukrainian military personnel and to destroy their military material."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.