Russian state-backed hackers are breaking into internet-connected security cameras in Europe and Ukraine to watch military logistics routes and help target Ukrainian forces, according to a public advisory from the Netherlands’ General Intelligence and Security Service, known as AIVD, and the Military Intelligence and Security Service, MIVD.
The July 10 advisory says at least one Russian intelligence service has been running cyber-espionage operations against cameras reachable from the public internet in the Netherlands, other NATO and EU countries, and Ukraine. The Dutch agencies said the campaign is aimed at gathering military intelligence, including information about transport routes and weapons shipments bound for Ukraine.
In Ukraine, the agencies said compromised cameras have in some cases been used to find Ukrainian military personnel. That intelligence was then used to support attempts to kill soldiers and destroy military equipment, according to the advisory. That is the ugly practical value of a badly secured camera: it stops being a cheap surveillance box and becomes someone else’s reconnaissance sensor.
How the camera intrusions work
According to AIVD and MIVD, the attackers scan the internet for exposed devices, identify IP cameras using manufacturer information, and take advantage of weak security. The advisory points to default passwords, outdated firmware and factory-default configurations as the kinds of mistakes the operators exploit.
After gaining access, the hackers analyze video feeds with image-recognition software, the agencies said. The software is used to spot military vehicles and cargo. That means the value is not only in watching a live feed; it is in turning many poorly protected feeds into a searchable monitoring system.
The Dutch agencies said they found a small number of compromised cameras along military logistics routes in the Netherlands. They framed the Netherlands as an attractive target because of its geography and its role supporting Ukraine. “As a key transit country, the Netherlands is an important espionage target due to its geographic location and its support for Ukraine,” the advisory said.
Moscow has repeatedly denied carrying out malicious cyber operations against Western countries.
Beyond shipments to Ukraine
The Dutch services also assessed that Russia is using compromised cameras to collect militarily relevant intelligence inside NATO and EU countries even when the activity is not tied directly to the war in Ukraine. The agencies said they have not seen Moscow use such information to support military attacks outside Ukraine.
Still, AIVD and MIVD said the campaign shows Russia can collect operational intelligence that could be useful in a later conflict. The advisory also said Russian state actors have steadily increased cyber-espionage operations in support of military operations since the start of the war against Ukraine.
The agencies urged organizations that run internet-connected cameras to fix the basics: replace default credentials, keep firmware current and review device settings. None of that is glamorous, which is why it keeps being ignored until an intelligence service turns the camera into infrastructure.
The advisory also told organizations to consider where cameras come from. It said countries including China, Russia and Iran conduct offensive cyber programs targeting Dutch interests. The agencies did not say that country of origin alone proves a device is compromised, but they presented it as one factor organizations should weigh when securing camera networks.
This story draws on original reporting from The Record.
