An Attacker Took Over 14,500+ Dahua Cameras in 35 Days

Sometimes all it takes is for the attacker to make a mistake. Analysts at Hunt.io found an unprotected working directory on a public HTTP server — 407 MB of data including source code, passwords, and camera snapshots — and thanks to that, they were able to reconstruct, step by step, an operation in which a single individual took control of over 14,500 Dahua cameras in 35 days. In today’s episode of Security Sunday, we add active attacks on Siemens S7 PLCs in critical infrastructure, a critical vulnerability in Elementor Pro, and the story of why a framed piece of severed cable hangs at T-Mobile headquarters.

Operation CameraSwarm: 14,500+ Dahua Cameras Taken Over

Threat intelligence company Hunt.io has published details of a large-scale campaign targeting security cameras, dubbed Operation CameraSwarm, in which a single attacker took control of more than 14,530 Dahua IP cameras between June 17 and July 22, 2026.

Confirmed and geolocated compromises were concentrated in Ukraine and Russia, with Ukraine accounting for the largest share. The scanning itself, however, was global: it first swept the Russian address space and then the entire IPv4 range.

The whole operation could be reconstructed thanks to a mistake by the attacker. Hunt.io discovered the attacker’s working directory exposed unprotected on a public HTTP server and obtained 407 MB of data — 2,616 files in 234 subdirectories containing source code, credentials, shell history, camera snapshots, and exploitation results.

The campaign ran along three parallel attack paths, each targeting a different weakness.

The first and largest was a brute-force attack against login credentials. The attacker scanned TCP port 37777 and managed to take over devices at 12,324 unique IP addresses. The captured camera snapshots were exported and stored the results in the format of Dahua’s SMART PSS management platform.

The second path exploited two older authentication-bypass vulnerabilities — CVE-2021–33044 and CVE-2021–33045 — to take control of 1,923 cameras. These flaws were patched five years ago. Anyone who hasn’t updated their firmware since then is still vulnerable today.

The third and most interesting path abused Dahua’s cloud service. Using only a device serial number and credentials hardcoded into every Dahua device, the attacker reached 283 cameras hidden behind NAT.

When people hear “hacked camera,” most imagine someone watching their living room. But that’s the smallest part of the problem.

We’re looking at a persistent backdoor that survives a reset. On nearly two thousand cameras, the attacker created a hidden account that, on most firmware versions, survives even a factory reset. Until an administrator manually finds and deletes this account, the camera remains accessible to the attacker.

The attacker is thus entrenched inside the network, and if you don’t have proper network segmentation in place — which, unfortunately, is still not the norm — they can move laterally across your infrastructure.

A compromised camera is simply an entry point: the attacker can use it for espionage, enlist it in a botnet, or pivot through it deeper into your network.

And this isn’t just theory: the Dutch military intelligence service warned this year that Russia is abusing precisely such unsecured cameras for espionage, using them to track military transports and weapons deliveries to Ukraine across Europe. Meanwhile, according to Shodan and Censys, thousands of such cameras are exposed to the internet in the Czech Republic and Slovakia.

And there is one more detail — a genuinely unsettling one, and I’d dare say it happens in our region too. The data repeatedly showed the same “non-random” passwords across dozens of different devices. The most likely explanation is that the devices were installed by a single company whose technician set the same password for all of their customers.

What’s the takeaway? Update your devices regularly, don’t expose to the internet what doesn’t need to be visible, and change not only default passwords but also the ones set by the vendor who installed your camera system.

US Agencies Warn of Attacks on Siemens S7 PLCs

On Wednesday, August 19, 2026, five US federal agencies issued a joint security advisory, AA26–231A, titled “Defending Against an Active Threat to Siemens S7 Series PLCs.” The advisory warns of attackers actively targeting Siemens S7 series programmable logic controllers (PLCs) deployed in US critical infrastructure.

PLCs are industrial computers that automate and control machinery and physical processes in factories, water utilities, and other key operations. The agencies stress that this is not a theoretical risk — the campaign is ongoing, and although the advisory focuses on Siemens devices, the targeting extends to other vendors as well.

The attackers use scanning services such as Censys and ZoomEye to find internet-exposed S7 series PLCs running outdated software or protected only by weak passwords.

They then deploy Python exploitation scripts, built with the help of AI, that use the open-source snap7.dll and python-snap7 libraries to communicate with the controllers over the S7comm protocol (TCP port 102).

These tools masquerade as legitimate OT-environment monitoring software and can give attackers read and write access to PLC memory.

The scope of the campaign is broad. Actively targeted devices include the Siemens S7–200, S7–300, S7–400, S7–1200, and S7–1500 families, and the most frequently targeted sectors are critical manufacturing, energy, water and wastewater treatment, the chemical industry, food and agriculture, and commercial facilities. The agencies also note that S7 series PLCs are used in the defense industry, which could become the next target.

I checked what Censys sees in the Czech Republic and Slovakia — dozens of PLC devices are readily reachable here as well, and some of them are indeed Siemens S7 units.

If you run a manufacturing plant, a wastewater treatment facility, or any other operation using these PLCs, check whether they are facing the internet — and are therefore a potential target for attackers. If you’re not sure how, get in touch; we’ll be happy to take a look.

T-Mobile Cut a Cable with Scissors to Evict Chinese Hackers from Its Network

On August 19, Bloomberg published a previously untold account by Jeff Simon — T-Mobile’s Chief Security Officer (CSO) at the time of the incident, and its Chief Information Officer (CIO) today — of how the US carrier drove Chinese state-backed hackers out of its network in November 2024.

Simon and three colleagues drove to a data center near T-Mobile’s headquarters in Bellevue, Washington, located the compromised hardware, and physically cut the cable connecting it to the outside world. The frayed piece of cable now hangs framed at company headquarters as a memento of the operation.

According to Bloomberg’s report, T-Mobile’s security team spent months fruitlessly hunting for the suspected attackers. The breakthrough came when analysts spotted unusual traffic that appeared to originate from a T-Mobile router in a California data center. When an employee physically checked the device, it was powered off. Further tracking led the team to the real source: a router in a Chicago data center belonging to another, unnamed telecom operator, deliberately disguised to impersonate the California T-Mobile device and blend its traffic in with the surroundings. The attackers had entered T-Mobile’s environment through the interconnected infrastructure of a compromised wireline partner.

The intrusion was part of the Salt Typhoon campaign, attributed to a hacking group backed by the Chinese government. The operation compromised major US carriers, and according to a later FBI estimate, the group breached at least 200 American companies.

Critical Elementor Pro Vulnerability (CVE-2026–32475) Turns a Contact Form into Unauthenticated RCE

Security researchers at Patchstack have disclosed a critical vulnerability in Elementor Pro, one of the most widely used page builders for WordPress.

The flaw, tracked as CVE-2026–32475 with a CVSS score of 9.0, allows a completely unauthenticated attacker to upload a PHP file through an ordinary web form and then execute it on the server. It is a textbook example of remote code execution (RCE).

The vulnerability is classified as CWE-434 (unrestricted upload of a file with a dangerous type) and affects all plugin versions up to and including 4.2.1.

Elementor released a fix in version 4.2.2 on August 19, 2026, with a public advisory following the same day. Given that the free base version of Elementor has more than 10 million active installations and Pro is its widely deployed paid edition, the potential scope of impact is considerable.