Loading story…
Dutch intelligence agencies AIVD and MIVD warned that Russian state-backed hackers are systematically compromising internet-connected IP cameras in the Netherlands, elsewhere in Europe, and Ukraine to support military espionage. The operation targets exposed cameras with default passwords, outdated firmware, and insecure default settings, then uses the video feeds to monitor NATO military logistics, including routes linked to weapons shipments bound for Ukraine. Dutch authorities said a small number of compromised cameras were identified along military logistics routes in the Netherlands, a key transit country for support to Kyiv.
The advisory said the campaign extends beyond supply-chain surveillance and, in Ukraine, compromised cameras have in some cases been used to help locate Ukrainian troops for attempted battlefield strikes. Investigators said the actors also apply image-recognition software to analyze footage for military vehicles and cargo, underscoring a broader Russian effort to collect militarily relevant intelligence inside NATO and EU countries. The Dutch services described the activity as an ongoing espionage operation and issued security guidance to help organizations secure internet-accessible cameras against further compromise.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
On 2026-07-10, Dutch intelligence services AIVD and MIVD published a security advisory warning that Russian state-backed actors were compromising internet-accessible IP cameras in the Netherlands, other European NATO countries, and Ukraine for military espionage. The advisory said the activity supported intelligence collection on NATO logistics and weapons shipments and included guidance to help defend against the campaign.
2 references tracked. Mallory keeps watching after this page renders.
therecord.media
Open sourceaivd.nl
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Dutch intelligence services warned that a Russian intelligence service is systematically compromising internet-connected security cameras in Europe and Ukraine to monitor military transport routes, weapons shipments bound for Kyiv, and Ukrainian troop positions. Authorities said the operation is ongoing and that, in Ukraine, access to breached cameras has been used in attempts to help locate personnel and destroy military equipment. The campaign reportedly targets cameras positioned along sensitive logistics corridors, with Dutch investigators identifying a limited number of compromised devices in the Netherlands and notifying affected organizations. Reporting indicates the operation relies primarily on weak security rather than novel exploits, including default passwords, unchanged factory settings, outdated firmware, and direct internet exposure. Censys said the exposed attack surface for vulnerable cameras across EU and NATO countries and Ukraine remains significant, while cautioning that exposure and version fingerprinting alone do not confirm compromise. Officials urged organizations to remove cameras from public internet access, disable port forwarding and `UPnP`, use VPN-based remote access, rotate default credentials, enable MFA where supported, patch firmware, and avoid camera views that reveal sensitive military or transport activity.
Jul 22, 2026
Researchers at Hunt.io uncovered two exposed directories that revealed parallel intrusion operations targeting internet-exposed infrastructure in Ukraine, particularly IP cameras and routers. One server at `89.208.97[.]165` contained evidence that a Ukrainian OpenCart-based e-commerce site had been compromised through SQL injection and repurposed as a proxy and staging node for Tor-routed intrusion attempts against Ukrainian government and military websites. The same server hosted a custom camera exploitation platform, **camview**, whose recovered data showed 58 compromised Ukrainian cameras, logs of live viewing sessions, and use of the open-source **Ingram** scanner against Dahua, Hikvision, D-Link, and Reolink devices. A second exposed directory at `213.165.63[.]49` showed a separate but similar operation using Russian-language tooling, **Ingram**, and custom scripts to scan and exploit routers and cameras across 15 European countries, with camera targeting concentrated on Ukraine. The toolkit focused on converting compromised TP-Link, MikroTik, and camera devices into **SOCKS5 proxies** and reverse tunnels over port `4444`, relying on stolen access, weak credentials, and known vulnerabilities, including `CVE-2021-33044`. Hunt.io said the activity was not attributed to a named threat actor or state entity, but the exposed infrastructure pointed to a low-cost, repeatable campaign aimed at Ukrainian targets using publicly available tools and long-patched flaws.
Aug 10, 2026
A joint government advisory says Russia’s GRU Unit 26165, also tracked as **APT28** or **Fancy Bear**, has run a sustained cyberespionage campaign against Western logistics providers, technology companies, and defense supply-chain organizations supporting aid flows to Ukraine. The activity has affected entities in the United States, Germany, Poland, France, and Ukraine, with intrusions aimed at transportation networks, IT services, and military-related logistics. Officials said the operators also sought visibility into aid movements by compromising internet-connected IP cameras positioned near border crossings, rail hubs, and military facilities. Authorities linked the campaign to long-running GRU tradecraft previously used against governments, militaries, defense contractors, and cloud and email environments including Microsoft Office 365 and on-premises Exchange. Reported access methods include password spraying, brute-force and credential-guessing attacks, spearphishing, exploitation of known vulnerabilities including `CVE-2020-0688` and `CVE-2020-17144`, and the use of malware such as **HEADLACE** and **MASEPIE**, alongside web shells, Tor, VPNs, and living-off-the-land techniques to persist and exfiltrate data. Agencies warned the espionage effort remains active and urged organizations to enforce MFA, patch exposed systems, tighten access controls, monitor for lateral movement, and review supply-chain risk.
Jun 29, 2026