Dahua Easy4IP Serial Predictability Fuels Ukraine Camera Hijacks at Scale

CERT-UA traced initial access to Easy4IP QR/SN enrollment where model prefixes remain constant across device families and five-character hex counters increment nearly sequentially. Attackers enumerated active cloud-linked units at volume, bypassing rate limits. Once identified, weak default credentials or unpatched instances of CVE-2021-33044 and CVE-2021-33045 permitted passwordless login and DVRIP protocol abuse from localhost. Audit logs showed 127.0.0.1 authentications as the signature of P2P relay compromise. Hunt.io telemetry documented two concurrent campaigns. One Russian-speaking cluster used Ingram scanner against exposed Dahua and Hikvision devices, netting 58 Ukrainian cameras plus router footholds across 15 European nations. Operation CameraSwarm, run by a single operator, compromised 14,530 Dahua units between 17 June and 22 July 2026 via the same CVE chain plus TCP 37777 scanning. Both efforts demonstrate serial enumeration scaling far beyond what CERT-UA quantified. The coverage understates downstream effects on personal safety. Compromised feeds in conflict zones enable physical surveillance, targeted intimidation, and potential integration into larger botnets for critical-infrastructure probing. Serial predictability combined with always-on P2P defaults creates a persistent attack surface that firmware updates alone cannot close if cloud linkage remains active. Next steps center on forced P2P disablement in new firmware, SN randomization in hardware revisions, and mandatory local-only management modes. Absent these changes, enumeration campaigns will continue expanding into adjacent Eastern European markets within the next quarter.