14,500 Dahua IP cameras compromised in 35-day CameraSwarm campaign

Thu, 20 Aug 2026 11:39:11 +0000

Engineer — Plan: If Dahua cameras are in scope, audit all units for default or weak credentials and remove any direct internet exposure; the campaign scale suggests opportunistic credential stuffing across this device class, but no KEV or PoC shifts this below Act.
SOC/IR — Learn: No IOCs or ATT&CK-mappable TTPs are surfaced in this item, and the compromise is geographically concentrated in Ukraine and Russia — limited detection work is actionable for a typical enterprise SOC without more detail.
Leader — Skip

Camera on CuraSec