Loading story…
Chinese-made camera components installed on Royal Navy K3 Scout surveillance drones were found to be transmitting data to China, prompting the UK Ministry of Defence to cut the cameras' internet connectivity after discovering the issue during a routine cyber vulnerability assessment. The affected uncrewed vessels, reportedly sourced through Kraken Technology Group from a third-party supplier that had provided security assurances, were used in Portsmouth Harbour and had been linked in reporting to operations involving Britain's special forces and planned Gulf missions.
The Ministry of Defence said it found no evidence that MoD data or systems were accessed, compromised, or transmitted externally, and stated that the traffic consisted only of non-sensitive "heartbeat communications" rather than operational imagery or classified information. The disclosure has nevertheless intensified scrutiny of Chinese technology embedded in Western defence platforms, particularly surveillance and drone systems used in sensitive military environments.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
The Telegraph reported that Royal Navy surveillance drones or uncrewed vessels used by Britain's special forces had Chinese-made camera components that secretly transmitted data to China. The report identified the affected platform as a K3 Scout uncrewed vessel used in Portsmouth Harbour.
The Royal Marines have used a £12 million fleet of K3 Scout drones since March. The drones were part of operations and had also been offered for deployment to support freedom of navigation in the Strait of Hormuz.
After discovering the issue, the UK Ministry of Defence removed all internet connectivity from the cameras on the affected K3 Scout drones. The ministry said its investigation found no evidence that MoD data or systems were accessed, compromised, or transmitted externally.
The UK Ministry of Defence said it identified a problem with camera components on K3 Scout drones during a routine cyber vulnerability assessment. The issue involved transmissions described as 'heartbeat communications' from the cameras.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
theregister.com
Open sourcetomshardware.com
Open sourcetelegraph.co.uk
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The UK Ministry of Defence is advancing legal changes in the *Armed Forces Bill* to give British defence personnel explicit authority to neutralize drones and other unmanned platforms deemed threatening near military bases and operations, a power currently more constrained and typically exercised by police and select agencies. The MoD cited a sharp rise in reported unmanned aerial intrusions near sensitive UK sites (266 in 2025 vs. 126 in 2024) and indicated the practical response will often rely on **electronic countermeasures** (e.g., RF jamming) rather than small-arms fire; recent examples and demonstrations referenced include RF jamming incidents and UK testing of **directed-energy** counter-drone systems (high-energy RF and laser-based capabilities). Separately, the U.S. Marine Corps’ 2nd Maintenance Battalion announced an **NDAA-compliant** modular drone, **HANX**, designed to avoid China-sourced parts and to be rapidly manufactured and repaired using **3D-printed components** in-house. The stated intent is to shorten procurement and sustainment timelines by reducing reliance on external contractors while enabling quick reconfiguration for missions ranging from reconnaissance to “one-way attack” roles, reflecting a broader push toward more secure, domestically supportable unmanned systems within U.S. defense organizations.
Jun 29, 2026
The UK Ministry of Defence reported a sharp increase in **drone sightings near British military bases**, citing **266 incidents** last year versus **126 in 2024**, and linked the trend to concerns about hostile reconnaissance of sensitive defence sites, including airbases used by the **US Air Force**. In response, the UK government is moving to expand authorities under the **Armed Forces Bill** so designated military personnel can directly intervene against threatening uncrewed systems—covering **air, land, and submersible drones**—without first requiring police involvement. In Ukraine, **SpaceX and Ukrainian authorities** implemented an **emergency measure** to disable **unauthorized Starlink terminals** being used to control Russian long-range drones, following reports that Russia continued leveraging Starlink-enabled connectivity for strikes deeper inside Ukraine. Ukrainian officials characterized the action as a temporary fix that may also disrupt some legitimate users, while SpaceX and Ukraine pursue a more durable approach to prevent unauthorized use of the satellite service in contested environments—highlighting how **commercial communications infrastructure** is being exploited as part of drone-enabled warfare and broader hybrid threats across Europe.
Jul 3, 2026
Dutch intelligence services warned that a Russian intelligence service is systematically compromising internet-connected security cameras in Europe and Ukraine to monitor military transport routes, weapons shipments bound for Kyiv, and Ukrainian troop positions. Authorities said the operation is ongoing and that, in Ukraine, access to breached cameras has been used in attempts to help locate personnel and destroy military equipment. The campaign reportedly targets cameras positioned along sensitive logistics corridors, with Dutch investigators identifying a limited number of compromised devices in the Netherlands and notifying affected organizations. Reporting indicates the operation relies primarily on weak security rather than novel exploits, including default passwords, unchanged factory settings, outdated firmware, and direct internet exposure. Censys said the exposed attack surface for vulnerable cameras across EU and NATO countries and Ukraine remains significant, while cautioning that exposure and version fingerprinting alone do not confirm compromise. Officials urged organizations to remove cameras from public internet access, disable port forwarding and `UPnP`, use VPN-based remote access, rotate default credentials, enable MFA where supported, patch firmware, and avoid camera views that reveal sensitive military or transport activity.
Jul 22, 2026