Threat Actor Hacks 14,000 IP Cameras in Ukraine and Russia

Post Views: 9

A cyber threat group executed a widespread intrusion campaign targeting Dahua IP cameras, resulting in the compromise of over 14,530 devices across Ukraine and Russia.

Operation CameraSwarm

The operation, designated as Operation CameraSwarm, spanned 35 days from June 17 to July 22. Initial activity involved scanning networks affiliated with Russian, Mexican, and Vietnamese internet service providers, later narrowing focus to Russian and Commonwealth of Independent States (CIS) telecommunications infrastructure.

Compromised Devices and Data

Security researchers analyzing the campaign discovered 2,616 files distributed across 234 subdirectories, totaling approximately 407 MB of data, stored in an exposed HTTP directory on the attacker’s servers. The dataset confirmed the compromise of 14,530 devices, with 12,324 unique IP addresses subjected to brute-force attacks.

Persistent Backdoor Account

The threat actor deployed a persistent backdoor account on 1,923 cameras via Remote Procedure Call (RPC) protocols. This account, utilizing the username and password combination \”p2pwn/p2password,\” remains unaffected by administrative password changes or factory resets on most firmware versions.

Vulnerabilities Exploited

The attackers leveraged a publicly available asyncio framework for credential brute-forcing and a compiled Go binary to bypass authentication. This binary exploited three vulnerabilities, including CVE-2021-33044 and CVE-2021-33045, alongside CVE-20244-39943, to establish the backdoor. CVE-2021-33044 exploits the firmware’s unconditional trust in client identifiers claiming to be NetKeyboard hardware controllers, bypassing password validation. CVE-2021-33045 allows unauthorized access by reading the source address from the request body rather than the TCP connection. These vulnerabilities enable the deployment of an administrative session without authentication.

Infrastructure and Toolkit

Researchers noted the threat actor had established the campaign’s infrastructure at least one year prior to the attacks. The toolkit included custom code alongside modified components from at least four other developers. Analysis suggests the toolkit was designed for third-party access, based on its transferable recovery-code architecture and enterprise-format export pipeline. However, no conclusive evidence of a commercial operation was found.

Report Findings and Recommendations

The report does not specify the attacker’s ultimate objectives or intended use of the compromised devices. The campaign highlights vulnerabilities in IoT device security, emphasizing the risks of default credentials, insufficient authentication mechanisms, and the reuse of compromised infrastructure. Organizations are advised to review firmware updates, enforce strong credential policies, and monitor for unauthorized access attempts.