Over 14,000 Dahua cameras pwned — and the attacker exposed his own toolkit
An operator compromised more than 14,000 Dahua IP cameras across Russia, Ukraine, Mexico, and Vietnam in 35 days — then left his working directory open on the web. Hunt.io rebuilt the whole campaign from his recovered files, mapping three parallel exploit paths and a backdoor account now sleeping on nearly 1,900 cameras, one that survives password changes and most factory resets. Offline recovery codes also grant cloud-level admin by serial number alone, a design that looks built for handing access to a buyer.