Attackers Hijack Dahua IP Cameras in Ukraine via P2P Access and Authentication Weaknesses

What happened

The Computer Emergency Response Team of Ukraine (CERT‑UA) issued an alert after multiple incidents in which threat actors gained unauthorized remote access to Dahua‑manufactured IP cameras and DVRs deployed across the country. Exploiting weaknesses in the devices’ peer‑to‑peer (P2P) access mechanism and default or weak authentication credentials, the attackers were able to view live video streams, alter device configurations, and create additional third‑party accounts for persistent control. The incidents were first observed in early October 2026 and were confirmed by the State Special Communications Service of Ukraine (SSSCIP). Dahua has since advised customers to reset passwords, disable unnecessary P2P services, and apply available firmware updates.

Why it matters for trust and compliance

• The breach demonstrates that insufficient identity and access‑control safeguards on IoT assets can erode audit‑ready control environments, making it essential to enforce strong authentication and continuous monitoring.
• Map authentication hardening to the access‑control control objective and capture evidence of password rotation and MFA enforcement.
• Leverage continuous monitoring logs to provide defensible evidence of unauthorized access attempts for audit purposes.

Who is affected

Recommended actions

1. Conduct a full inventory of all Dahua (or similar) cameras and verify that default credentials have been changed.
2. Disable P2P remote‑access features unless explicitly required, and restrict any remaining access to trusted network zones.
3. Implement multi‑factor authentication or certificate‑based authentication for device management interfaces.
4. Enable logging of authentication events and configuration changes; integrate logs into a SIEM for real‑time alerting.
5. Document remediation steps and retain logs as audit evidence of control remediation.