Zero Radar
← feed
HighSecurity incidentupdated 27 Oct 2026, 06:59 UTC

Attackers take over Dahua security cameras and recorders in Ukraine

Hackers are getting into internet-connected Dahua security cameras and video recorders. Once inside, they can watch live video, change settings, and create their own login accounts.

Attacks reported (The Hacker News, The Record)2 independent sources
SeverityHighSecurity incident
Being exploited?ReportedBy The Hacker News, The Record, not officially confirmed yet
What to doCheck exposureDisable unneeded P2P remote access and change passwords on every Dahua camera and recorder now.
How sure is this?2 independent sourcesSeveral independent publishers agree

How the attack works simplified

  1. 1Attacker scansFinds internet-connected Dahua devices
  2. 2Weak accessAbuses P2P access and weak authentication
  3. 3Device taken overAttacker logs in to the camera or recorder
  4. 4Accounts addedCreates unauthorized third-party accounts
  5. 5Video exposedLive video streams accessed and settings changed
  6. ResultAttacker keeps control of the cameras

What happened

CERT-UA reports unauthorized remote access to Dahua IP cameras and DVRs, abusing peer-to-peer (P2P) remote access features and weak authentication. Attackers accessed video streams, changed device configurations, and created third-party accounts.

Why it is dangerous: Compromised cameras expose private video footage and give attackers a foothold to change device settings and keep access, putting organizations and individuals who use these cameras at risk.

Are you affected?

You are affected if you use Dahua IP cameras or DVRs connected to the internet, especially with P2P remote access enabled.

Dahua IP cameras and DVRs (specific models and firmware versions not stated in the material).

What to do

  1. Check whether P2P or remote cloud access is enabled on Dahua devices and disable it if you do not need it
  2. Change default and weak passwords on all cameras and recorders to strong, unique ones
  3. Review user accounts on each device and delete any accounts you do not recognize
  4. Keep Dahua devices off direct internet exposure, placing them behind a firewall or VPN where possible

Timeline

  1. 26 Oct 2026, 14:21 UTC
    Publicly disclosed
  2. 26 Oct 2026, 14:31 UTC
    Picked up by Zero Radar
  3. 27 Oct 2026, 06:34 UTC
    Reported by The Hacker News · The Hacker News
  4. 27 Oct 2026, 06:59 UTC
    The Record reported on it · The Record

Sources 2 reports, oldest first

Security press established security newsrooms

Technical details

ID
ZR-ad878331 · ZR-d72684f8
Disclosed
26 Oct 2026, 14:21 UTC
On Zero Radar
26 Oct 2026, 14:31 UTC (10 min after disclosure)
Last change
27 Oct 2026, 06:59 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Attackers take over Dahua security cameras and recorders in Ukraine · Zero Radar