NATO logistics, Ukrainian troops are top subjects of Russian camera hacks, advisory says
Russian state-backed hackers are systematically compromising internet-connected security cameras across Europe and Ukraine to gather intelligence on NATO military logistics and identify Ukrainian troops for targeting. The Dutch intelligence agencies warn that this campaign is part of a broader effort to collect operational intelligence, potentially for future conflicts.
Dutch intelligence agencies have issued a warning about a systematic cyber espionage campaign targeting internet-connected security cameras across Europe and Ukraine. The General Intelligence and Security Service (AIVD) and Military Intelligence and Security Service (MIVD) revealed that Russian state-backed hackers are exploiting vulnerabilities in these cameras to collect military intelligence, specifically focusing on NATO logistics and identifying Ukrainian troops for potential targeting.
The goal is to monitor military transport routes and weapons shipments destined for Ukraine, and in Ukraine, hacked cameras have been used to locate Ukrainian military personnel, with the intelligence subsequently supporting attempts to kill soldiers and destroy equipment. The Dutch agencies identified a small number of compromised cameras positioned along military logistics routes in the Netherlands as part of the broader operation.
According to the advisory, the attackers scan the internet for exposed devices, identify IP cameras based on manufacturer information and exploit weak security, including default passwords, outdated firmware and default configurations. The hackers then automatically analyze video feeds using image-recognition software to identify military vehicles and their cargo.
Beyond the war, the Dutch intelligence services assess that Russia is also using the cameras to collect militarily relevant intelligence inside NATO and EU countries even when it is unrelated to Ukraine. While they said they have not observed Moscow using such information to support military attacks outside Ukraine, the campaign "demonstrates Russia's ability to collect operational intelligence that could be used in a future conflict."
The advisory urged organizations operating internet-connected cameras to strengthen their security by changing default credentials, keeping firmware up to date and reviewing device configurations. It also advised organizations to consider cameras’ country of origin, noting that countries including China, Russia, and Iran actively conduct offensive cyber programs targeting Dutch interests.