Ukraine Says Hackers Are Hijacking Chinese Dahua Cameras by Guessing Serial Numbers That Count Up in Order

Ukraine is fighting a war in which a hacked camera can reveal an air defense position, and many of its cameras are made by Chinese manufacturer Dahua. Now the country's CERT-UA says attackers are walking into those devices through Dahua's own cloud feature, simply by guessing serial numbers that barely change from one unit to the next.

CERT-UA and the State Special Communications Service warned late last week that intruders had compromised Dahua IP cameras and video recorders, watched their streams, changed settings and created their own user accounts. The agency did not say how many devices were hit, when, who was targeted or who was behind it.

A serial number is not a password

The way in is Easy4IP, Dahua's peer-to-peer cloud service that lets owners view cameras, NVRs and DVRs from a phone app or browser by scanning a QR code or typing in the serial number. It links devices through the cloud even when they sit behind a firewall and cannot be reached directly from the internet. Hiding the camera does not help.

The serial numbers are easy to predict: a 10-character model prefix shared by every unit in a product family, followed by a five-character hexadecimal counter that climbs almost in sequence, as in 7K01F36PCA003E8. Attackers can guess them at scale and check which ones are cloud connected without hitting rate limits or lockouts. "The assumption that the serial number is unknown to anyone is not a reason to consider the device secure," CERT-UA wrote.

Once a device answers, the intruders try weak or default passwords, or use two old authentication bypass bugs in outdated firmware, CVE-2021-33044 and CVE-2021-33045, which allow login with no password at all. Telltale signs include unknown accounts, unexplained configuration changes and audit logs showing logins over Dahua's DVRIP protocol from 127.0.0.1, which points to peer-to-peer access. CERT-UA's advice is to turn off P2P where it is not needed, keep devices off the open internet and update the firmware.

Backdoors that survive a reset

Security firm Hunt.io had already tracked two related campaigns. One was a Russian-speaking operator who broke into 58 internet-exposed cameras in Ukraine with known Dahua and Hikvision flaws and scanned routers and cameras across 15 European countries. The other, dubbed Operation CameraSwarm, was a lone actor who compromised more than 14,530 Dahua cameras between June 17 and July 22, 2026, mostly in Ukraine and Russia.

In that campaign, 1,923 cameras received a hidden account that survives a password change and, on most firmware, a factory reset. Another 283 were reached by serial number alone through Dahua's cloud relay, mostly with no credentials. Hunt.io said the methods closely match CERT-UA's findings but there is no evidence tying them to the same hackers, and that deleting rogue accounts is not enough without a firmware update.

Cameras on the front line

The stakes in Ukraine are not abstract. In January 2024 the SBU said Russian intelligence hacked two residential building cameras in Kyiv to watch air defenses and critical infrastructure, streaming the footage to YouTube. The SBU has since identified and secured about 40,000 cameras, and a 2024 RFE/RL investigation counted roughly 24,000 Dahua and Hikvision cameras in Ukrainian municipal systems. A July 2026 Dutch intelligence bulletin said Russian actors break into IP cameras across the EU, NATO and Ukraine and run image recognition to spot military vehicles and weapon deliveries.

Ukraine knows what Russian crews do once they get inside a network, from spying to Sandworm wiping a Ukrainian grain firm, and hijacked recorders elsewhere have ended up rented out as residential proxies. Yet procurement records show Ukrainian government institutions and military units kept buying Dahua equipment in 2026, from a company Washington blacklisted in 2019 over its alleged role in the surveillance of Uyghurs in Xinjiang.

Some offers on this page may be paid placements or contain affiliate links.