Russian military intelligence services are actively hijacking internet-connected security cameras across Europe and Ukraine to monitor military transport routes, weapons shipments to Kyiv, and Ukrainian troop positions, according to a joint alert issued on July 10 by the Netherlands General Intelligence and Security Service (AIVD) and the Military Intelligence and Security Service (MIVD).
The compromised cameras are not merely passive observers. In Ukraine, the live video feeds have been directly integrated into targeting processes, effectively turning ordinary commercial devices into battlefield aiming tools for strikes against Ukrainian military personnel and equipment. Similar access persists in EU and NATO countries, where the footage is used to gather broader military intelligence unrelated to direct combat operations.
The intrusion technique is disturbingly simple. Attackers use internet-wide scans to identify exposed IP cameras by brand fingerprints, then log directly into devices that still retain factory-default passwords, outdated firmware, or unchanged out-of-the-box configurations. No zero-day vulnerabilities are required. Once inside, image-recognition software automatically scans the video streams for military vehicles and cargo, eliminating the need for continuous human monitoring.
Internet scanning firm Censys mapped the exposure surface and found more than 87,000 cameras running services with known vulnerabilities across the EU, NATO member states, and Ukraine, including over 4,000 devices in Ukraine. In the Netherlands alone, Censys identified 45,386 publicly accessible cameras, of which 1,992 ran vulnerable services. Narrowing the scope to camera-specific software vulnerabilities reduced the Dutch figure to 541 devices.
Two specific vulnerabilities highlighted by Censys are CVE-2016-7407 affecting the Dropbear SSH server and CVE-2021-39275 in Apache HTTP Server version 2.4.49. Both issues were patched years ago and are not listed in CISA’s Known Exploited Vulnerabilities catalog, yet Censys still flagged hundreds of matching hosts.
Although the total number of confirmed compromised cameras remains lower than the overall exposure count, their locations are strategically critical. Many sit along Dutch military transport corridors, prompting authorities to notify affected organizations and request immediate isolation of the devices.
The agencies issued straightforward defensive recommendations: identify all publicly exposed cameras via forgotten port forwards or UPnP mappings, move video streams behind VPNs, replace default passwords and enable multi-factor authentication where possible, adjust camera angles to avoid sensitive logistics areas, and apply security updates promptly while choosing devices with long support lifecycles.
