Loading story…
Researchers at Hunt.io uncovered two exposed directories that revealed parallel intrusion operations targeting internet-exposed infrastructure in Ukraine, particularly IP cameras and routers. One server at 89.208.97[.]165 contained evidence that a Ukrainian OpenCart-based e-commerce site had been compromised through SQL injection and repurposed as a proxy and staging node for Tor-routed intrusion attempts against Ukrainian government and military websites. The same server hosted a custom camera exploitation platform, camview, whose recovered data showed 58 compromised Ukrainian cameras, logs of live viewing sessions, and use of the open-source Ingram scanner against Dahua, Hikvision, D-Link, and Reolink devices.
A second exposed directory at 213.165.63[.]49 showed a separate but similar operation using Russian-language tooling, Ingram, and custom scripts to scan and exploit routers and cameras across 15 European countries, with camera targeting concentrated on Ukraine. The toolkit focused on converting compromised TP-Link, MikroTik, and camera devices into SOCKS5 proxies and reverse tunnels over port 4444, relying on stolen access, weak credentials, and known vulnerabilities, including CVE-2021-33044. Hunt.io said the activity was not attributed to a named threat actor or state entity, but the exposed infrastructure pointed to a low-cost, repeatable campaign aimed at Ukrainian targets using publicly available tools and long-patched flaws.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
Hunt.io published research describing two exposed directories that revealed separate but similar operations targeting Ukrainian cameras, routers, and websites using stolen access, weak credentials, and known vulnerabilities. The report documented a compromised Ukrainian OpenCart site used as a proxy and staging point, plus camview data showing 58 compromised Ukrainian cameras and live viewing logs.
Hunt.io notified CERT-UA about its findings on two exposed directories linked to operations targeting Ukrainian internet-exposed infrastructure. The company then held publication for a seven-day disclosure window.
A second open directory was discovered on 213.165.63.49:8080, exposing 1,704 files tied to attacks on TP-Link Archer routers, MikroTik devices, and IP cameras across 15 European countries including Ukraine. Hunt.io later linked this infrastructure to a related russophone operation using exploits, brute force, SOCKS5 proxy setup, and Chisel reverse tunnels.
Attack Capture identified 89.208.97[.]165 as a malicious open directory. Hunt.io later tied that exposed server to tooling, logs, and files from an operation targeting Ukrainian websites and cameras.
Hunt.io reported that the camview toolkit used by the operator tested CVE-2021-33044 among several known camera vulnerabilities against internet-exposed devices in Ukraine. The reference does not anchor when the operator began using this CVE, only that it was part of the recovered tooling.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcereddit.com
Open sourcehunt.io
Open sourcecve.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reconstructed **Operation CameraSwarm**, a 35-day campaign that compromised more than **14,530 Dahua IP cameras**, with the largest concentration of affected devices in **Ukraine and Russia**. The operation was pieced together from an exposed directory on `154.86.119.60` containing the operator’s tooling, logs, source code, and staging files. According to the report, the attackers used three parallel access paths: credential brute forcing on `TCP/37777`, exploitation of **`CVE-2021-33044`** and **`CVE-2021-33045`**, and abuse of Dahua’s **P2P cloud relay** to reach cameras by serial number. Researchers said the relay path relied on cloud-issued session tokens obtainable through fixed SDK credentials embedded in Dahua clients, enabling unauthenticated access through that channel. The operators also installed a persistent backdoor account, **`p2pwn` / `p2password`**, on **1,923 cameras**; the account reportedly survives password changes and, on most firmware, even factory resets, while offline-generated recovery codes could provide additional cloud-level administrative reset capability by serial number. Hunt.io said some CVE labels used in the tooling were incorrect, including a misreference to **`CVE-2024-39943`** and an overbroad use of **`CVE-2025-31702`**, and it made no attribution claim for the campaign. The same host also staged a separate UPX-packed Windows payload believed to be **SalatStealer** and a PowerShell script for Microsoft Defender exclusions. Defenders were urged to treat exposed Dahua cameras as potentially compromised, remove the `p2pwn` account, rotate credentials, disable P2P where unnecessary, and apply firmware updates covered by **Dahua `SA-2021-0130`**.
Sep 4, 2026
Dutch intelligence services warned that a Russian intelligence service is systematically compromising internet-connected security cameras in Europe and Ukraine to monitor military transport routes, weapons shipments bound for Kyiv, and Ukrainian troop positions. Authorities said the operation is ongoing and that, in Ukraine, access to breached cameras has been used in attempts to help locate personnel and destroy military equipment. The campaign reportedly targets cameras positioned along sensitive logistics corridors, with Dutch investigators identifying a limited number of compromised devices in the Netherlands and notifying affected organizations. Reporting indicates the operation relies primarily on weak security rather than novel exploits, including default passwords, unchanged factory settings, outdated firmware, and direct internet exposure. Censys said the exposed attack surface for vulnerable cameras across EU and NATO countries and Ukraine remains significant, while cautioning that exposure and version fingerprinting alone do not confirm compromise. Officials urged organizations to remove cameras from public internet access, disable port forwarding and `UPnP`, use VPN-based remote access, rotate default credentials, enable MFA where supported, patch firmware, and avoid camera views that reveal sensitive military or transport activity.
Jul 22, 2026
Russian and China-linked threat activity has relied on common but effective entry points to penetrate government, telecom, defense, energy, and other critical-sector networks. Ukrainian officials said CERT-UA recorded **5,927 cyber incidents** in 2025, a **37.4% increase** over the prior year, with Russian groups including **UAC-0002 (Sandworm)**, **UAC-0001 (APT28)**, **UAC-0010 (Gamaredon)**, and **UAC-0190 (Void Blizzard)** using exposed **RDP** services, vulnerable **VPN** appliances, supply-chain compromise, phishing, and stolen credentials to gain access. Separately, telecom intrusions tied to the China-linked cluster **UAT-9244** used exposed web applications, **ProxyLogon**, exposed **SSH** services, weak credentials, and unpatched server software to establish footholds in Linux-heavy environments. Once inside, the actors deployed a broad toolset for espionage, persistence, and disruption, including RATs, stealers, ransomware, wipers, and Linux malware such as **PeerTime**, which supports multiple architectures and uses peer-to-peer, BitTorrent-like communications to avoid reliance on centralized command-and-control. The reporting highlights exploitation of products including **Cisco ASA/AnyConnect**, **Roundcube**, **Fortinet**, **WinRAR**, **7-Zip**, and legacy Microsoft Office components, alongside social-engineering tactics such as **ClickFix**, device-code phishing, OAuth phishing, and QR-code hijacking. The campaigns also abused legitimate services and native system tools, while under-monitored embedded Linux devices, routers, edge systems, and container hosts were described as especially attractive for long-term persistence, lateral movement, scanning, and covert communications.
Jun 29, 2026