#FactCheck - Digitally Altered Image Falsely Shows World Bank President Ajay Banga Holding Khalistani Flag

Introduction

Not every major breach begins with a sophisticated new exploit. Sometimes it begins with a device nobody remembered to update, and this one began exactly that way, at scale. Security researchers have disclosed a campaign that compromised more than 14,530 internet connected cameras made by Dahua Technology, (one of the world's largest surveillance equipment manufacturers), using a mix of stolen credentials, two long known authentication flaws, and a peer to peer relay technique that let attackers reach devices tucked behind home and office routers. The operation, tracked by researchers at Hunt.io, has been named Operation CameraSwarm. It ran between June 17 and July 22, 2026, and was reconstructed almost entirely from an exposed 407 megabyte working directory the attackers themselves left accessible, containing over 2,600 files, campaign logs, shell history, and tooling. Confirmed compromises were concentrated in Ukraine and Russia, and researchers described the operators/attackers as Russian speaking based on language artifacts found in the recovered material, suggesting the campaign was most plausibly built around surveillance or access relevant to the ongoing conflict between the two countries, though no formal attribution to a named threat actor or state entity has been established or claimed. What makes this worth understanding in detail is not just the scale, though 14,500 compromised cameras is a serious number, but how mundane the actual break in methods were. None of this depended on the attackers discovering some brand new, unknown flaw, the kind of vulnerability security researchers call a ‘zero day’. It depended on something far more ordinary: thousands of devices running years-old software that had never been patched, combined with cheap automated tools that could try weak passwords and known exploits at scale.

What is Dahua, and why does this matter

Dahua Technology, founded in Hangzhou in 2001, is a publicly traded, partially state owned Chinese company and the world's second largest video surveillance manufacturer by revenue, trailing only fellow Chinese firm Hikvision. Its cameras, digital video recorders, and network video recorders are sold in roughly 180 countries through more than 2,100 partners, and the company has shipped tens of millions of devices into homes, retail stores, offices, and public infrastructure worldwide. That scale is precisely what makes any systemic vulnerability in Dahua's product line consequential well beyond a single country or sector.

How the attackers actually got in

Hunt.io attributed the compromises to three distinct attack paths. The largest, by far, was straightforward credential attacks, essentially automated login guessing using weak, default, or previously leaked passwords, which researchers traced to 12,324 unique IP addresses across more than 13,000 recorded campaign attempts. The second path exploited two authentication bypass flaws, catalogued as CVE-2021-33044 and CVE-2021-33045, both rated a severe 9.8 out of 10 on the current CVSS severity scale used by the US National Vulnerability Database. These are not new vulnerabilities. They were publicly disclosed back in 2021, and Dahua issued fixed firmware for them years ago, yet both remain listed today on the US Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog, a designation reserved specifically for flaws still being actively exploited in the wild despite available patches. The third and most technically interesting path involved a peer to peer, or P2P, relay mechanism built into Dahua's own Easy4IP cloud infrastructure, a system designed to let users remotely access their camera without manually configuring network settings. Security firm ITRES Labs, which documented this exposure separately in 2025, found that on firmware released before mid-2024, simply knowing a device's serial number was enough to establish a connection route through Dahua's relay servers before the camera's own login check ever kicked in, a design gap that let attackers reach devices even when they sat behind network address translation, the technical barrier that normally shields home devices from direct internet exposure. Hunt.io's recovered operator logs claimed an extraordinary 89.4 percent of live serial numbers tested returned an open channel without any authentication at all, though it is worth noting that figure comes solely from the attackers' own recovered data and has not been independently verified by Dahua, ITRES Labs, or any public incident response body as of this writing. Beyond the initial break in, the campaign also planted 1,923 cameras with a persistent account, essentially a backdoor login the operators could return to later, and researchers found evidence suggesting parts of the toolkit may have been built specifically to hand off access to a third party, though no confirmed link to a named threat actor or state sponsor has been established.

Why cameras remain such a persistent target

Internet connected cameras occupy an unusual position in the broader device ecosystem. Unlike a laptop or phone, they are rarely patched by an end user paying regular attention, they are often installed once and forgotten, and many owners never change the default credentials shipped from the factory. A compromised camera also offers an attacker something more than a foothold, live or recorded video feeds of homes, businesses, and sometimes sensitive facilities, which carries value well beyond the kind of access a compromised laptop typically provides.

CyberPeace Advisory | What device owners should do now

For anyone running Dahua surveillance equipment, or any internet connected camera system, several concrete steps meaningfully reduce exposure.

For Dahua device owners specifically:

Two steps address the exact mechanisms this campaign exploited.

• First, check the device's firmware version against Dahua's official download portal and apply the latest available update immediately, since the fixes for both 2021 authentication bypass vulnerabilities have existed for years and simply have not been applied on thousands of devices.
• Second, disable the P2P or Easy4IP remote access feature entirely unless it is actively required, since this is the exact mechanism the third attack path, the serial number based relay, relied on to reach cameras without any login check at all.

For any internet connected camera system, including in India:

The remaining precautions apply regardless of manufacturer, and are worth following on any brand of camera, DVR, or NVR connected to the internet.

• Replace default or weak passwords with strong, unique credentials on every camera and recorder, and remove any unused or unrecognised accounts, since the persistent account technique this campaign used depends entirely on unnoticed access surviving unchecked.
• Place surveillance devices on a segmented network separate from computers and phones, so that a compromised camera cannot become a stepping stone into more sensitive systems.
• Periodically audit which devices on a home or office network are internet facing at all, since many cameras end up exposed simply because remote access was left switched on by default and nobody thought to check.
• And where a device offers the option, disable any built in peer to peer or cloud relay convenience feature unless genuinely needed, since the underlying design pattern this campaign exploited, a remote access shortcut that runs before proper authentication.Is not unique to Dahua and has shown up across other camera brands in the past.

‍

The view from India

This disclosure lands at a particularly relevant moment for India, which enforced sweeping new restrictions on Chinese origin CCTV equipment earlier this year. Since April 1, 2026, internet connected surveillance cameras sold in India have been required to carry Standardisation Testing and Quality Certification under Essential Requirements norms first introduced by the Ministry of Electronics and Information Technology in April 2024, It's a country-of-origin requirement under the Essential Requirements norms (introduced by India's Ministry of Electronics and Information Technology in April 2024), manufacturers must disclose the origin of key components like the System-on-Chip (SoC), and devices using Chinese-origin chipsets are reportedly not being granted approval by certifying authorities. Since Dahua's cameras, like Hikvision's and TP-Link's, generally rely on Chinese-made chipsets, the practical effect is that their products haven't received STQC certification, which functions as a blanket exclusion without the government needing to name any single company in the rule text itself. The stated rationale for that policy, concerns over hidden backdoor access, transmission of data to foreign servers, and deployment near sensitive locations, reads almost like a preview of exactly the kind of exposure Operation CameraSwarm has now documented in the wild. It is worth being precise here: the restriction applies to new sales, not existing installations, and CameraSwarm's confirmed victims were concentrated in Ukraine and Russia rather than India. But the underlying lesson travels well beyond any one country's borders. A camera manufactured with a convenience feature that bypasses its own login check, sitting unpatched for years despite a fix being publicly available, is a vulnerability that does not respect national boundaries, and India's decision to tighten certification requirements before an incident of this scale surfaced looks, in hindsight, considerably more prudent than reactive.

References

1. The Hacker News, "Hackers Compromised 14,500+ Dahua Devices Using Credential Attacks, Auth Bypasses, and P2P." August 19, 2026. https://thehackernews.com/2026/08/hackers-compromised-14500-dahua-devices.html
2. Hunt.io, "Operation CameraSwarm: Dahua Cameras Compromised." https://hunt.io/blog/operation-cameraswarm-dahua-cameras-compromised
3. ITRES Labs, "Dahua Beyond CVE-2025-31702: P2P Relay Exposure." October 29, 2025. https://labs.itresit.es/2025/10/29/dahua-beyond-cve-2025-31702-p2p-relay-exposure?
4. Dahua Security, "DHCC-SA-202106-001: Security Advisory - Identity Authentication Bypass Vulnerability Found in Some Dahua Products." https://www.dahuasecurity.com/about-dahua/trust-center/dahua-psirt/dhcc-sa-202106-001%3Asecurity-advisory---identity-authentication-bypass-vulnerability-found-in-some-dahua-products
5. National Vulnerability Database, "CVE-2021-33044 Detail." https://nvd.nist.gov/vuln/detail/CVE-2021-33044
6. CISA, "Known Exploited Vulnerabilities Catalog." https://www.cisa.gov/known-exploited-vulnerabilities-catalog
7. Business Standard, "India to ban Chinese CCTV from Apr 1 as security concerns reshape market." https://www.business-standard.com/industry/news/india-ban-chinese-cctv-government-security-concerns-hikvision-dahua-market-126033000316_1.html
8. PTC News, "India CCTV ban 2026: Hikvision, Dahua face STQC block as new security rules begin." https://www.ptcnews.tv/amp/nation/india-cctv-ban-hikvision-dahua-stqc-rules-2026-4422961
9. Uyghur Human Rights Project, "Surveillance Tech Series: Dahua's Links to Human Rights Abuses in East Turkistan." https://uhrp.org/report/dahuas-links-to-human-rights-abuses-in-east-turkistan/

‍

Introduction

‍

We were all stunned and taken aback when multiple photos of streets in the U.S. surfaced with heavily drugged individuals loosely sitting on the streets, victims of a systematically led drug operation that has recently become a target of the Trump-led “tariff” war, which he terms as a war on drug cartels. The drug is a synthetic opioid, fentanyl, which is highly powerful and addictive. The menace of this drug is found in a country that has Wall Street and the largest and most powerful economy globally. The serious implications of drug abuse are not about a certain economy; instead, it has huge costs to society in general. The estimated cost of substance misuse to society is more than $820 billion each year and is expected to continue rising. 

On June 26, the International Day against Drug Abuse and Illicit Trafficking is observed globally. However, this war is waged daily for millions of people, not on streets or borders, but in bloodstreams, behind locked doors, and inside broken homes. Drug abuse is no longer a health crisis; it is a developmental crisis. The United Nations Office on Drugs and Crime has launched a campaign against this organised crime that says, “Break the Cycle’ attributing to the fact that de-addiction is hard for individuals. 

The Evolving Drug Crisis: From Alleyways to Algorithms

‍

The menace of Drug abuse and illicit trafficking has also taken strides in advancement, and what was once considered a street-side vice has made its way online in a faceless, encrypted, and algorithmically optimised sense. The online drug cartels operate in the shadows and often hide in plain sight, taking advantage of the privacy designed to benefit individuals. With the help of darknet markets, cryptocurrency, and anonymised logistics, the drug trade has transformed into a transnational, tech-enabled industry on a global scale. In an operation led by the U.S. Department of Justice’s Joint Criminal Opiod and Darknet Enforcement (JCODE) and related to Operation RapTor, an LA apartment was only to find an organised business centre that operated as a hub of one of the most prolific methamphetamine and cocaine distributors in the market. Aaron Pinder, Unit Chief of the FBI Hi-Tech Organised Crime Unit, said in his interview, “The darknet vendors that we investigate, they truly operate on a global scale.” On January 11, 2025, during the Regional Conference on “Drug Trafficking and National Security,” it was acknowledged how cryptocurrency, the dark web, online marketplaces, and drones have made drug trafficking a faceless crime. Reportedly, there has been a seven-fold increase in the drugs seized from 2004-14 to 2014-24. 

‍

India’s Response: Bridging Borders, Policing Bytes

‍

India has been historically vulnerable due to its geostrategic placement between the Golden Crescent (Afghanistan-Iran-Pakistan) and Golden Triangle (Myanmar-Laos-Thailand), and confronts a fresh danger from “click-to-consume’ narcotics. Although India has always adopted a highly sensitised approach, it holds an optimistic future outlook for the youth. Last year, to commemorate the occasion of International Day against Drug Abuse and Illicit Trafficking, the Department of Social Justice & Empowerment organised a programme to engage individuals for the cause. The Indian authorities are often seen coming down heavily on the drug peddlers and cartels, and to aid the cause, the Home Minister Amit Shah inaugurated the new office complex of the NCB’s Bhopal zonal unit and extension of the MANAS-2 helpline to all 36 states and UTs. The primary objectives of this step are to evaluate the effectiveness of the Narcotics Coordination Mechanism (NCORD), assess the progress of states in fighting drug trafficking, and share real-time information from the National Narcotics Helpline ‘MANAS’ portal with the Anti-Narcotics Task Force (ANTF) of states and UTs. 

‍

The United Nation’s War on Narcotics: From Treaties to Technology

‍

The United Nations Office on Drugs and Crime (UNODC) is leading the international response. It offers vital data, early warning systems, and technical support to the states fighting the drug problem. The UNODC incorporates cooperation in cross-border intelligence, overseeing the darknet activities, encouraging the treatment and harm reduction, and using anti-money laundering mechanisms to stop financial flows. India has always pledged its support to the UN led activities, and as per reports dated 26th March, 2025, India chaired the prestigious UN-backed Commission on Narcotic Drugs (CND) meeting held in vienna, wherein India highlighted the importance of opioids for medical purposes as well as the nation’s notable advancements in the field. 

‍

Resolution on June 26: From Commemoration to Commitment

‍

Let June 26 be more than a date on the calendar- let it echo as a call to action, a day when awareness transforms into action, and resolve becomes resistance. On this day, CyberPeace resolves the following:

‍

• To treat addicts as victims rather than criminals and to pitch for reforms to provide access to reasonably priced, stigma-free rehabilitation.
• To integrate anti-drug awareness into digital literacy initiatives and school curricula in order to teach frequently and early.
• To demand responsibility and accountability from online marketplaces and delivery services that unwittingly aid traffickers
• To tackle the demand side through employment, mental health services, and social protection, particularly for at-risk youth.

‍

References

• https://www.gatewayfoundation.org/blog/cost-of-drug-addiction/#:~:text=The%20estimated%20cost%20for%20substance,Alcohol%3A%20%24249%20billion 
• https://www.unodc.org/unodc/en/drugs/index-new.html 
• https://www.fbi.gov/news/stories/global-operation-targets-darknet-drug-trafficking 
• https://www.thehindu.com/news/national/dark-web-crypto-drones-emerge-as-challenges-in-fight-against-drug-trafficking-amit-shah/article69088383.ece 
• https://www.pib.gov.in/PressReleaseIframePage.aspx?PRID=2028704 
• https://www.newindianexpress.com/nation/2025/Mar/26/in-a-first-india-chairs-un-forum-on-narcotics-pledges-to-improve-access-to-pain-relief-and-palliative-care 

‍

Executive Summary:

A video gone viral on Facebook claims Union Finance Minister Nirmala Sitharaman endorsed the government’s new investment project.  The video has been widely shared. However, our research indicates that the video has been AI altered and is being used to spread misinformation.

‍

Claim: 

‍

The claim in this video suggests that Finance Minister Nirmala Sitharaman is endorsing an automotive system that promises daily earnings of ₹15,00,000 with an initial investment of ₹21,000.

‍

Fact Check:

‍

To check the genuineness of the claim, we used the keyword search for “Nirmala Sitharaman investment program” but we haven’t found any investment related scheme. We observed that the lip movements appeared unnatural and did not align perfectly with the speech, leading us to suspect that the video may have been AI-manipulated.

When we reverse searched the video which led us to this DD News live-stream of Sitharaman’s press conference after presenting the Union Budget on February 1, 2025. Sitharaman never mentioned any investment or trading platform during the press conference, showing that the viral video was digitally altered. Technical analysis using Hive moderator further found that the viral clip is Manipulated by voice cloning.

‍

Conclusion:

The viral video on social media shows Union Finance Minister Nirmala Sitharaman endorsing the government’s new investment project as completely voice cloned, manipulated and false. This highlights the risk of online manipulation, making it crucial to verify news with credible sources before sharing it. With the growing risk of AI-generated misinformation, promoting media literacy is essential in the fight against false information.

• Claim: Fake video falsely claims FM Nirmala Sitharaman endorsed an investment scheme.
• Claimed On: Social Media
• Fact Check: False and Misleading 

‍