Ukraine's cyber agency says attackers are watching and reconfiguring Dahua cameras. Owners of these cameras anywhere should check their settings now.
Ukraine's cyber agency, CERT-UA, has warned that attackers are taking over Dahua security cameras and video recorders. They can watch the live video, change the settings and add accounts of their own. The warning was issued last week through Ukraine's State Special Communications Service.
The main way in is Easy4IP, Dahua's remote-viewing service. It lets owners check on a home or small business from a phone app or web browser by scanning a QR code or typing in the device's serial number. The trouble is that the serial numbers follow a pattern. Part of each number is the same for every unit in a product family, and the rest is a counter that goes up almost one at a time. Attackers can guess them in bulk and see which devices are online.
CERT-UA says guessing does not trigger lockouts, so every device with this feature on is at risk, even one that cannot be reached directly from the internet. Once a device is found, attackers get in with weak or well-known passwords, or by using two known flaws in old software, CVE-2021-33044 and CVE-2021-33045.
CERT-UA has not said who was targeted, when, how many devices were hit or who is behind it. Security firm Hunt.io has described similar campaigns. One, named Operation CameraSwarm, reportedly broke into over 14,530 Dahua cameras between June 17 and July 22, 2026. About 1,923 of them got a hidden account called p2pwn that survives a password change and, on most software versions, a factory reset. Another 283 were reached through Dahua's cloud relay using only the serial number.
A camera is meant to protect a space, not expose it. Anyone who gets in can see inside a home or business and change the device's settings. Dutch intelligence agencies warned in July 2026 that Russian actors are breaking into cameras across the E.U., NATO states and Ukraine to gather military intelligence. They use image recognition software to search footage for military vehicles and cargo.
Owners whose cameras have remote viewing turned off, current software and strong, unique passwords are in a much better position. The reported attacks center on Ukraine, but the weaknesses are in the devices, and the Hunt.io scanning reached 15 European countries.
The steps in the alert box above cover the essentials. Because the hidden account can survive a factory reset, a reset alone is not a safe fix. Look through the device's account list for the name p2pwn or anything else you did not create.
More detail may come from CERT-UA and Hunt.io, including how many devices were hit and who is responsible. Until then, treat any Dahua camera with remote access on and old software as exposed.
If you own a Dahua camera or recorder, turn off remote viewing you do not use, update the software and check for accounts you did not create.
Morristown police say scammers posing as bank staff are pushing people to withdraw cash, which is very hard to get back once it is handed over.
Read more: Morristown police warn of scam where fake bank staff ask for cashA viral ChatGPT prompt turns what the chatbot remembers about you into a room image. Posting it publicly could give scammers clues to target you.
Read more: Viral ChatGPT room image could hand scammers clues about youA message saying your Amazon account was hacked is often the scam itself. Checking in the Amazon app first can protect your card, gift balance and phone.
Read more: If Amazon says your account was hacked, check before you call
