Date: 08/19/2026
Severity: High
Summary
Between June 17 and July 22, 2026, a single operator compromised more than 14,000 Dahua IP cameras worldwide. The campaign began with masscan sweeps targeting Russian IP ranges before expanding across the entire IPv4 address space. The largest number of compromised devices initially came from Mexican and Vietnamese ISP ranges, followed by increased activity against Russian and CIS networks. Among confirmed and geolocated victims, Ukraine and Russia accounted for the largest concentrations, with Ukraine having the highest share. This marks the second Dahua camera compromise operation traced to an exposed operator directory within just two weeks. Unlike the previous campaign involving 58 cameras, this operation used a much broader scanning and compromise infrastructure, demonstrating a significantly larger scale.
Indicators of Compromise (IOC) List
Domains/URLs | easy4ipcloud.com vk.com/wall-163997495 dahuaddns.com quickddns.com |
IP Address | 154.86.119.60 185.132.53.56 |
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 : | dstipaddress IN ("185.132.53.56","154.86.119.60") or srcipaddress IN ("185.132.53.56","154.86.119.60") |
Detection Query 2 : | domainname like "easy4ipcloud.com" or url like "easy4ipcloud.com" or siteurl like "easy4ipcloud.com" or domainname like "quickddns.com" or url like "quickddns.com" or siteurl like "quickddns.com" or domainname like "dahuaddns.com" or url like "dahuaddns.com" or siteurl like "dahuaddns.com" or domainname like "vk.com/wall-163997495" or url like "vk.com/wall-163997495" or siteurl like "vk.com/wall-163997495" |
Reference:
https://hunt.io/blog/operation-cameraswarm-dahua-cameras-compromised