Loading story…
Researchers at Hunt.io uncovered two exposed directories that revealed parallel intrusion operations targeting internet-exposed infrastructure in Ukraine, particularly IP cameras and routers. One server at 89.208.97[.]165 contained evidence that a Ukrainian OpenCart-based e-commerce site had been compromised through SQL injection and repurposed as a proxy and staging node for Tor-routed intrusion attempts against Ukrainian government and military websites. The same server hosted a custom camera exploitation platform, camview, whose recovered data showed 58 compromised Ukrainian cameras, logs of live viewing sessions, and use of the open-source Ingram scanner against Dahua, Hikvision, D-Link, and Reolink devices.
A second exposed directory at 213.165.63[.]49 showed a separate but similar operation using Russian-language tooling, Ingram, and custom scripts to scan and exploit routers and cameras across 15 European countries, with camera targeting concentrated on Ukraine. The toolkit focused on converting compromised TP-Link, MikroTik, and camera devices into SOCKS5 proxies and reverse tunnels over port 4444, relying on stolen access, weak credentials, and known vulnerabilities, including CVE-2021-33044. Hunt.io said the activity was not attributed to a named threat actor or state entity, but the exposed infrastructure pointed to a low-cost, repeatable campaign aimed at Ukrainian targets using publicly available tools and long-patched flaws.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Hunt.io published research describing two exposed directories that revealed separate but similar operations targeting Ukrainian cameras, routers, and websites using stolen access, weak credentials, and known vulnerabilities. The report documented a compromised Ukrainian OpenCart site used as a proxy and staging point, plus camview data showing 58 compromised Ukrainian cameras and live viewing logs.
Hunt.io notified CERT-UA about its findings on two exposed directories linked to operations targeting Ukrainian internet-exposed infrastructure. The company then held publication for a seven-day disclosure window.
Attack Capture identified 89.208.97[.]165 as a malicious open directory. Hunt.io later tied that exposed server to tooling, logs, and files from an operation targeting Ukrainian websites and cameras.
Hunt.io reported that the camview toolkit used by the operator tested CVE-2021-33044 among several known camera vulnerabilities against internet-exposed devices in Ukraine. The reference does not anchor when the operator began using this CVE, only that it was part of the recovered tooling.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
reddit.com
Open sourcehunt.io
Open sourcecve.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Dutch intelligence services warned that a Russian intelligence service is systematically compromising internet-connected security cameras in Europe and Ukraine to monitor military transport routes, weapons shipments bound for Kyiv, and Ukrainian troop positions. Authorities said the operation is ongoing and that, in Ukraine, access to breached cameras has been used in attempts to help locate personnel and destroy military equipment. The campaign reportedly targets cameras positioned along sensitive logistics corridors, with Dutch investigators identifying a limited number of compromised devices in the Netherlands and notifying affected organizations. Reporting indicates the operation relies primarily on weak security rather than novel exploits, including default passwords, unchanged factory settings, outdated firmware, and direct internet exposure. Censys said the exposed attack surface for vulnerable cameras across EU and NATO countries and Ukraine remains significant, while cautioning that exposure and version fingerprinting alone do not confirm compromise. Officials urged organizations to remove cameras from public internet access, disable port forwarding and `UPnP`, use VPN-based remote access, rotate default credentials, enable MFA where supported, patch firmware, and avoid camera views that reveal sensitive military or transport activity.
Jul 22, 2026
Russian and China-linked threat activity has relied on common but effective entry points to penetrate government, telecom, defense, energy, and other critical-sector networks. Ukrainian officials said CERT-UA recorded **5,927 cyber incidents** in 2025, a **37.4% increase** over the prior year, with Russian groups including **UAC-0002 (Sandworm)**, **UAC-0001 (APT28)**, **UAC-0010 (Gamaredon)**, and **UAC-0190 (Void Blizzard)** using exposed **RDP** services, vulnerable **VPN** appliances, supply-chain compromise, phishing, and stolen credentials to gain access. Separately, telecom intrusions tied to the China-linked cluster **UAT-9244** used exposed web applications, **ProxyLogon**, exposed **SSH** services, weak credentials, and unpatched server software to establish footholds in Linux-heavy environments. Once inside, the actors deployed a broad toolset for espionage, persistence, and disruption, including RATs, stealers, ransomware, wipers, and Linux malware such as **PeerTime**, which supports multiple architectures and uses peer-to-peer, BitTorrent-like communications to avoid reliance on centralized command-and-control. The reporting highlights exploitation of products including **Cisco ASA/AnyConnect**, **Roundcube**, **Fortinet**, **WinRAR**, **7-Zip**, and legacy Microsoft Office components, alongside social-engineering tactics such as **ClickFix**, device-code phishing, OAuth phishing, and QR-code hijacking. The campaigns also abused legitimate services and native system tools, while under-monitored embedded Linux devices, routers, edge systems, and container hosts were described as especially attractive for long-term persistence, lateral movement, scanning, and covert communications.
Jun 29, 2026
Dutch intelligence agencies **AIVD** and **MIVD** warned that Russian state-backed hackers are systematically compromising internet-connected **IP cameras** in the Netherlands, elsewhere in Europe, and Ukraine to support military espionage. The operation targets exposed cameras with **default passwords**, **outdated firmware**, and insecure default settings, then uses the video feeds to monitor **NATO military logistics**, including routes linked to weapons shipments bound for Ukraine. Dutch authorities said a small number of compromised cameras were identified along military logistics routes in the Netherlands, a key transit country for support to Kyiv. The advisory said the campaign extends beyond supply-chain surveillance and, in Ukraine, compromised cameras have in some cases been used to help locate **Ukrainian troops** for attempted battlefield strikes. Investigators said the actors also apply **image-recognition software** to analyze footage for military vehicles and cargo, underscoring a broader Russian effort to collect militarily relevant intelligence inside **NATO** and **EU** countries. The Dutch services described the activity as an ongoing espionage operation and issued security guidance to help organizations secure internet-accessible cameras against further compromise.
Jul 14, 2026