Loading story…
Slovakia’s National Security Bureau (NBÚ) issued a cybersecurity alert after analyzing NERO R-ONE road-speed cameras used in the country’s traffic monitoring system and finding what it described as a significant cyber threat. The agency said the devices, reportedly rebranded Russian CORDON PRO.M units made by Semicon/Simicon in St. Petersburg, contained a backdoor capable of executing malicious code delivered by SMS from hardcoded Russian phone numbers. NBÚ also reported discrepancies between the products’ declared and actual hardware and software origin, undocumented communication interfaces, preconfigured remote access and management functions, mismatches in measurement-processing software, disabled SecureBoot, vulnerabilities in the web management portal, and unauthenticated exposure of live video streams.
The warning covers NERO R-ONE by SODASUS as well as Cordon-series products linked to Simicon and NEROline, and NBÚ urged essential service operators and other organizations to identify any such devices in their infrastructure and report them. The cameras were procured through a no-bid contract from a Cyprus shell company under a €30 million EU-funded project, with 279 units installed on Slovak roads. Following the findings, Slovakia’s Interior Ministry paused further deployment and said it would seek an independent audit to verify the report, while the observed risks were aligned with MITRE ATT&CK techniques T1195.003 for hardware supply-chain compromise and T1133 for external remote services.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
On 2026-08-14, Slovakia's National Security Bureau (NBÚ) published an official cybersecurity alert, issued at the request of the Interior Ministry, covering NERO R-ONE and certain Cordon-series road radar products. NBÚ classified the matter as a significant cyber threat and told operators to identify affected products in their infrastructure and report any presence to the agency.
After NBÚ's findings, the Slovak Interior Ministry deactivated NERO R-ONE traffic cameras that had already been installed and configured. This went beyond merely pausing deployment while an independent review of NBÚ's conclusions was expected.
Following NBÚ's report, Slovakia's Interior Ministry paused deployment of the traffic cameras. The ministry also said it would commission an independent audit or additional assessment to verify NBÚ's findings.
NBÚ's technical analysis of a borrowed NERO R-ONE sample found multiple serious issues, including a backdoor that could execute malicious code via SMS from hardcoded Russian phone numbers, disabled SecureBoot, vulnerabilities in the web management portal, exposed live video streams, undocumented or inaccessible remote-management mechanisms, and mismatches between declared and actual hardware, software, and measurement-processing components. NBÚ also assessed the NERO R-ONE cameras as rebranded Russian CORDON PRO.M units made by Semicon in St. Petersburg.
Slovak media reported concerns about the procurement of NERO R-ONE traffic cameras, including that they were bought through a no-bid direct contract involving a Cyprus shell company with fake certifications. These reports prompted Slovakia's national security authority NBÚ to begin investigating the devices.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
5 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcetomshardware.com
Open sourcecyberveille.ch
Open sourcenews.risky.biz
Open sourcenbu.gov.sk
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Dutch intelligence services warned that a Russian intelligence service is systematically compromising internet-connected security cameras in Europe and Ukraine to monitor military transport routes, weapons shipments bound for Kyiv, and Ukrainian troop positions. Authorities said the operation is ongoing and that, in Ukraine, access to breached cameras has been used in attempts to help locate personnel and destroy military equipment. The campaign reportedly targets cameras positioned along sensitive logistics corridors, with Dutch investigators identifying a limited number of compromised devices in the Netherlands and notifying affected organizations. Reporting indicates the operation relies primarily on weak security rather than novel exploits, including default passwords, unchanged factory settings, outdated firmware, and direct internet exposure. Censys said the exposed attack surface for vulnerable cameras across EU and NATO countries and Ukraine remains significant, while cautioning that exposure and version fingerprinting alone do not confirm compromise. Officials urged organizations to remove cameras from public internet access, disable port forwarding and `UPnP`, use VPN-based remote access, rotate default credentials, enable MFA where supported, patch firmware, and avoid camera views that reveal sensitive military or transport activity.
Jul 22, 2026
Dutch intelligence agencies **AIVD** and **MIVD** warned that Russian state-backed hackers are systematically compromising internet-connected **IP cameras** in the Netherlands, elsewhere in Europe, and Ukraine to support military espionage. The operation targets exposed cameras with **default passwords**, **outdated firmware**, and insecure default settings, then uses the video feeds to monitor **NATO military logistics**, including routes linked to weapons shipments bound for Ukraine. Dutch authorities said a small number of compromised cameras were identified along military logistics routes in the Netherlands, a key transit country for support to Kyiv. The advisory said the campaign extends beyond supply-chain surveillance and, in Ukraine, compromised cameras have in some cases been used to help locate **Ukrainian troops** for attempted battlefield strikes. Investigators said the actors also apply **image-recognition software** to analyze footage for military vehicles and cargo, underscoring a broader Russian effort to collect militarily relevant intelligence inside **NATO** and **EU** countries. The Dutch services described the activity as an ongoing espionage operation and issued security guidance to help organizations secure internet-accessible cameras against further compromise.
Aug 31, 2026
Slovakia’s Ministry of Investments, Regional Development and Informatization (MIRRI SR) and the Slovak Government CSIRT have rolled out an integrated cybersecurity service portfolio for public administration, shifting from isolated technology deployments toward operational security services designed to prevent incidents and improve readiness. The program combines threat intelligence sharing through **Afrodita**, centralized management of internet-facing vulnerabilities through **Achilles**, manual penetration testing via **Ares**, practical skills development in **Kyberaréna**, and an **Early Warning System** that correlates security data across participating organizations. The services are offered free of charge to public-sector IT administrators and were developed under Slovakia’s Recovery and Resilience Plan. Officials said the model is intended to strengthen early threat detection, coordinated response, and day-to-day cyber resilience across government entities, while also extending awareness efforts to the public through the **Fakt alebo Mýtus** cybersecurity education game aimed at improving citizen cyber hygiene.
Aug 7, 2026