Ukraine's computer emergency response team, CERT-UA, said late last week that it had identified cases in which hackers compromised internet-connected Dahua cameras and video recorders, changed their settings and created unauthorised user accounts, The Record from Recorded Future News reported on 26 October 2026.

According to The Record, CERT-UA did not say how many devices were compromised, when the attacks happened or who was responsible.

The Record reports that, according to CERT-UA, the attackers appear to be exploiting Easy4IP, a feature that lets users reach Dahua cameras remotely through the manufacturer's cloud service and that connects devices using their serial numbers even when they sit behind firewalls or cannot be reached directly from the internet.

CERT-UA said the serial numbers follow predictable patterns, so attackers can guess large numbers of them and find cloud-connected cameras, which means devices with the remote access feature turned on could be exposed even if their serial numbers were never published, according to The Record. Once a device is found, attackers can try weak or default passwords or exploit flaws in outdated firmware that bypass authentication, and CERT-UA specifically warned about two critical vulnerabilities disclosed in 2021, CVE-2021-33044 and CVE-2021-33045, which affect certain Dahua cameras and video recorders, The Record reports.