[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fJXr_pucVkv8edsonkrpcoCyDwGYcUkQEzGEP7y9p9nY":3},{"article":4,"iocs":46,"watch_terms":47,"solutions":48,"lesson":130},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"08e859f1-ba1f-43d8-acaa-693cd3156560","Attackers Hijack Dahua IP Cameras in Ukraine Using P2P Access and Auth Weaknesses","attackers-hijack-dahua-ip-cameras-in-ukraine-using-p2p-access-and-auth-weaknesse-a2da89","The Computer Emergency Response Team of Ukraine (CERT-UA) has issued an alert warning of unauthorized remote access to video surveillance systems manufactured by Dahua. \"Cases of compromising IP cameras and DVRs with access to the video stream, changing the device configuration and creating third-party accounts have been recorded,\" the State Special Communications Service of Ukraine (SSSCIP)","CERT-UA has warned of attackers gaining unauthorized remote access to Dahua IP cameras and DVRs in Ukraine. The attackers are reportedly exploiting P2P access and authentication weaknesses to compromise devices, access video streams, alter configurations, and create unauthorized accounts.","Dahua IP cameras in Ukraine compromised via P2P access and weak authentication.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fattackers-hijack-dahua-ip-cameras-in.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEjISG9SXb2aeE6Zy-bIbnuaqwUNmGof7xU8RQl0vGZIcxcgNE3YXpuvG7rJKSTn_q9J8d_2DEv6rU2zxoX615DIYePz9rMA2TiLT6Fo1q2leGoyH85hJuIUta8j8FEN2mY5AGaO6zH5o6MkCHZ9Sv7OpjrZ6LE1yZygl9R4hUgt7xWJMMeGXRI4UJziuPCW\u002Fs1600\u002Fhackers-camera.jpg","2026-10-27T06:34:47+00:00","2026-10-27T07:00:22.13423+00:00",7,[17,20,23,26],{"name":18,"type":19},"Dahua","vendor",{"name":21,"type":22},"Unknown attackers","threat_actor",{"name":24,"type":25},"IP Cameras","product",{"name":27,"type":25},"DVRs","d6f63bb8-0801-486a-be7f-171400700454",{"id":28,"icon":30,"name":31,"slug":32},null,"IoT\u002FOT","iot-ot",[34,39,41],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":40},{"id":28,"icon":30,"name":31,"slug":32},{"category":42},{"id":43,"icon":30,"name":44,"slug":45},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[18,24,27],{"controls":49,"vendors":129},[50,79,100],{"slug":51,"name":52,"problem":53,"products":54},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[55,63,71],{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":59,"product_name":60,"url":61,"description":62},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":80,"name":81,"problem":82,"products":83},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[84,92],{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":101,"name":102,"problem":103,"products":104},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",[105,113,121],{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"illumio","Illumio","\u002Fvendor-logos\u002Fillumio.png","illumio-segmentation","Illumio Segmentation","https:\u002F\u002Fwww.illumio.com\u002Fillumio-segmentation","Maps traffic between workloads and enforces segmentation across data centre, cloud and endpoints.",{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","guardicore-segmentation","Akamai Guardicore Segmentation","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fakamai-guardicore-segmentation","Software-based microsegmentation with traffic visibility.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","zero-trust-endpoint-firewall","Zero Trust Endpoint Firewall","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fzero-trust-endpoint-firewall","Centrally managed host firewall with device-level and dynamic access rules, to limit which machines can talk to each other.",[],{"slug":131,"title":132,"body":133,"framework_refs":134,"framework_notes":142},"dahua-ip-cameras-hijacked-via-p2p-and-weak-authentication","Dahua IP Cameras Hijacked via P2P and Weak Authentication","Attackers exploited Dahua IP cameras and DVRs in Ukraine by abusing built-in peer-to-peer (P2P) connectivity features alongside weak or default authentication controls, gaining unauthorized access to live video feeds, device configurations, and user accounts. This incident highlights the danger of internet-connected surveillance devices shipped or deployed with insecure defaults and rarely reviewed post-installation. IoT and IP camera deployments are frequently overlooked in security hardening cycles, making them attractive pivot points for espionage and infrastructure reconnaissance. The ability to alter configurations and create rogue accounts means attackers can maintain persistent access long after initial compromise is detected.",[135,136,137,138,139,140,141],"CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 12: Network Infrastructure Management","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIS2 Article 21(2)(b)","MITRE ATT&CK T1133: External Remote Services",{"NIS2 Article 21(2)(b)":143,"NIST SP 800-53 SI-2: Flaw Remediation":144,"MITRE ATT&CK T1133: External Remote Services":145,"CIS Control 12: Network Infrastructure Management":146,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":147,"CIS Control 4: Secure Configuration of Enterprise Assets and Software":148,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":149},"NIS2 mandates incident handling and security measures for network and information systems in critical sectors; Ukrainian operators of surveillance infrastructure are required to implement controls addressing authentication weaknesses and unauthorized access scenarios exactly like this one.","Known firmware vulnerabilities and insecure P2P implementation in Dahua devices require a structured flaw remediation process including timely patching and verification of fixes across all deployed units.","Attackers abused Dahua's built-in P2P remote access feature as an external remote service entry point, a technique ATT&CK T1133 covers, underscoring the need to inventory and restrict all vendor-provided remote access mechanisms.","Placing IP cameras on isolated, segmented network zones with strict egress filtering would have prevented attackers from leveraging P2P connectivity to reach external command infrastructure.","This control requires organizations to identify, assess, and remediate technical vulnerabilities in a timely manner, which would have driven firmware updates and P2P feature hardening before exploitation occurred.","Cameras were exploited through insecure defaults and P2P features left enabled; CIS Control 4 requires establishing and maintaining secure configurations for all devices, including disabling unnecessary services and changing default credentials.","The attack succeeded in part due to authentication weaknesses; this framework function requires that identities are managed, credentials are protected, and access to assets is controlled and verified."]