INGRAMIngram

Ingram is an open-source Python webcam vulnerability scanner published on GitHub by jorhelp under GPL-3.0, a dual-use tool described by its author as for security testing only. It fingerprints cameras from Hikvision, Dahua, Uniview, D-Link and other vendors and tests them against known vulnerabilities and weak credentials; the repository references CVE-2017-7921, CVE-2020-25078, CVE-2021-33044 and CVE-2021-36260. In August 2026 Hunt.io reported two open directories of Russian-speaking operators that used it: on the first server, a containerised tool called 'camview' wrapped Ingram instead of custom exploits, and JSON files listed 58 compromised cameras in Ukraine (mostly Hikvision and Dahua, around Odessa, Burshtyn and Kherson), with Hunt.io listing CVE-2017-7921, CVE-2020-25078, CVE-2020-25169, CVE-2021-33044, CVE-2021-33045 and CVE-2021-36260 as Ingram targets; on a second, unrelated server, an all_ingram.csv target list contained only Ukrainian IP addresses, alongside scripts against MikroTik devices and TP-Link Archer routers (CVE-2024-53375 chained with CVE-2024-57049) and router scanning across 15 European countries including France, where Hunt.io found no sign of successful exploitation. Hunt.io ties neither directory to a state actor or named group; the shared tool is the only link between them. The Hacker News later related these findings to an October 2026 CERT-UA/SSSCIP alert on Dahua cameras accessed through the Easy4IP P2P platform, which does not mention Ingram.