Russian Intelligence Hacks IP Cameras to Spy on Military Logistics Across NATO States and Ukraine
Russian intelligence services are systematically exploiting internet-connected security cameras across Europe and Ukraine to gather military intelligence, including tracking military transport routes and targeting Ukrainian troops. The AIVD and MIVD, the Dutch intelligence agencies, have uncovered a widespread operation where cameras are accessed using default credentials, outdated firmware, and vulnerabilities like CVE-2016-7407 and CVE-2021-39275. While only a small number of cameras have been directly breached, the sheer number of exposed devices – over 87,000 across the EU, NATO, and Ukraine – presents a significant risk due to the ability to gain a live view of physical operations without needing to compromise the network itself.
Russian intelligence services are systematically hijacking internet-connected security cameras across Europe and Ukraine to gather military intelligence, including tracking military transport routes, weapons shipments bound for Kyiv, and the locations of Ukrainian troops. The AIVD and MIVD, the Netherlands’ civilian and military intelligence services, have uncovered a widespread operation where cameras are accessed using default credentials, outdated firmware, and vulnerabilities like CVE-2016-7407 and CVE-2021-39275.
Those version matches deserve their own caveat: a service banner is not a reachable exploit. Of the two bugs Censys highlights, CVE-2016-7407 sits in dropbearconvert, a local key-import tool in the Dropbear SSH server that runs code only when someone converts a malicious key file. It was fixed in July 2016, and Censys flagged 159 Dutch hosts for it. CVE-2021-39275 is an out-of-bounds write that Apache itself rates low, since no bundled module feeds untrusted data to the affected function, though a third-party one might. It was patched in Apache 2.4.49 in 2021, and 112 Dutch hosts run a matching version. Censys counts both as exploited in the wild, though neither sits in CISA's Known Exploited Vulnerabilities catalog.
Set that exposed surface against confirmed intrusions. In a separate statement, the Dutch services said they had actually caught only a small number of cameras breached, sitting directly on military logistics routes inside the Netherlands, and that the organisations running them have since been warned so they could lock things down. The recommended fixes are the dull, effective ones: Start by finding what is exposed: which cameras are reachable from the public internet through a forgotten port-forward, a UPnP mapping, or a vendor cloud relay. Prioritise the ones overlooking transport routes, ports, and other sensitive sites, and check their logs for access you do not recognise. Keep the video stream off the public internet: turn off port forwarding and UPnP, and reach cameras through a VPN. Replace default credentials and turn on MFA where the device supports it; where it does not, keep that camera off the public internet entirely. Aim the lens deliberately: keep logistics routes, loading docks, and other sensitive spots out of frame, and mask what you cannot avoid. Patch firmware and software, and when it is time to buy, choose cameras that ship with years of security support, not months. The services say they have not observed camera-derived intelligence being used for military attacks outside Ukraine. What makes the threat portable is how ordinary both halves are: the entry is often just a default login, and the value is set by where the camera happens to point. A compromised camera hands an adversary a live read on physical operations, when the trucks move, and who comes and goes, no deeper breach of the network required. The fix, then, is not just patching the device; it is taking it off the public internet and controlling what it can see.