Ukraine warns hackers are exploiting Chinese-made Dahua surveillance cameras

Ukrainian government cybersecurity researchers have warned that hackers are gaining unauthorized access to surveillance cameras made by Chinese manufacturer Dahua, potentially exposing video feeds and allowing attackers to remotely control the devices.

Ukraine’s computer emergency response team, CERT-UA, said late last week that it had identified cases in which hackers compromised the internet-connected cameras and video recorders, changed their settings and created unauthorized user accounts.

The agency did not say how many devices had been compromised, when the attacks occurred or who was responsible. Chinese-made surveillance equipment remains widely used in Ukraine, including by government institutions and military units.

According to CERT-UA, the attackers appear to be exploiting a feature called Easy4IP, which allows users to access Dahua cameras remotely through the manufacturer’s cloud service. The feature connects devices to the cloud using their serial numbers, even when the devices are protected by firewalls or cannot be accessed directly over the internet.

CERT-UA said the serial numbers follow predictable patterns, allowing hackers to guess large numbers of them and identify cameras connected to the cloud. As a result, devices with the remote access feature enabled could be vulnerable even if their serial numbers have never been publicly disclosed.

Once a device is identified, attackers can attempt to gain access by guessing weak or default passwords or exploiting security flaws in outdated firmware that allow them to bypass authentication.

The agency specifically warned about two critical vulnerabilities, CVE-2021-33044 and CVE-2021-33045, disclosed in 2021, that affect certain Dahua cameras and video recorders.

Researchers at cybersecurity firm Hunt.io reported in August that hackers had compromised more than 14,500 Dahua devices earlier in the summer, with confirmed infections concentrated in Ukraine and Russia. The attackers reportedly used similar techniques, although it remains unclear whether the incidents are connected to those described by CERT-UA.

Hunt.io told Recorded Future News that the methods described by CERT-UA closely match those used in the earlier campaign, but there is no evidence linking the attacks to the same hackers.

The servers used in the earlier campaign remain online, although researchers have found no new copies of the attackers’ toolkit since July. Hunt.io cautioned that the lack of evidence does not mean the attacks have stopped, as the hackers appear to have restricted access to the files that originally exposed their operations.

The company also said that compromised cameras could remain accessible to hackers months later because malicious accounts and recovery codes can survive password changes and, on most firmware versions, factory resets. The researchers said removing the accounts is not enough to secure the devices without updating their firmware.

Dahua is one of China’s largest manufacturers of video surveillance equipment, producing security cameras, recording systems and facial recognition technology.

The company has faced restrictions in the United States over national security and human rights concerns. In 2018, Congress prohibited federal agencies from procuring certain Dahua equipment, and the following year, Washington placed the company on a trade blacklist over its alleged role in the surveillance and repression of Uyghurs and other predominantly Muslim minorities in China’s Xinjiang region.

Surveillance risks in wartime

The warning comes amid longstanding concerns in Ukraine that surveillance cameras could be exploited by Russian intelligence services to monitor military movements and critical infrastructure.

Earlier this month, The Wall Street Journal reported that Ukraine’s domestic security agency, the SBU, had identified and secured approximately 40,000 surveillance cameras since Russia launched its full-scale invasion in 2022, amid concerns that they could be used to gather military intelligence.

In January 2024, the SBU said Russian intelligence services had hacked two cameras installed on residential buildings in Kyiv and used them to monitor air defense activity and critical infrastructure. The cameras, originally installed to monitor nearby streets and parking areas, were allegedly reconfigured by Russian operatives to change their viewing angles and stream footage to YouTube.

A 2024 investigation by Radio Free Europe/Radio Liberty found that approximately 24,000 cameras manufactured by Dahua and another Chinese company, Hikvision, were installed in municipal surveillance systems across Ukraine.

Ukrainian public procurement records show that government institutions and military units continued to purchase Dahua equipment in 2026 despite longstanding security concerns.

It remains unclear whether any of the devices identified in CERT-UA’s latest warning belong to Ukrainian government agencies or military organizations.