# Russian Intelligence Services Hijack Unsecured IP Cameras Across NATO, EU and Ukraine to Surveil Weapons Deliveries (AIVD/MIVD Advisory, Censys Analysis)

> Dutch intelligence services AIVD and MIVD, in a joint advisory published July 10, 2026, confirm that at least one Russian intelligence service is systematically compromising internet-connected IP cameras across the Netherlands, EU, NATO countries, and Ukraine to surveil weapons deliveries and military transport routes supporting Ukraine. Censys analysis found more than 87,000 exposed cameras across eight European countries and Ukraine running services matching known-exploited vulnerabilities, with camera access in Ukraine reportedly used to help target Ukrainian military personnel and equipment.

- **Published:** 2026-07-22T00:00:00Z
- **Last reviewed:** 2026-07-22T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1624
- **ID:** TL-2026-1624
- **Severity:** HIGH (CVSS 9.8)
- **Category:** ESPIONAGE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 15 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2016-7407, CVE-2021-39275

## Description

On July 10, 2026, the Netherlands' civilian intelligence service (AIVD -- Algemene Inlichtingen- en Veiligheidsdienst) and military intelligence service (MIVD -- Militaire Inlichtingen- en Veiligheidsdienst) jointly published an advisory warning that at least one Russian intelligence service is conducting a large-scale, ongoing digital espionage campaign against civilian internet-connected IP cameras. Rather than penetrating hardened, defended military networks, the operation targets poorly secured, internet-facing surveillance cameras overlooking roads, ports, loading areas, gas stations, and other logistics routes used to move Western weapons and equipment to Kyiv. Operators scan the public internet for exposed camera devices, fingerprint them by brand, and gain access via default passwords, outdated/unpatched firmware, and factory-default configurations -- no zero-day exploits are required. Once inside, AI-powered image-recognition software automatically searches captured video for military vehicles, cargo, transport routes, and personnel, correlating findings across many compromised feeds at scale to build a picture of Western military logistics supporting Ukraine. The advisory frames this as a systematic escalation of digital espionage activity since Russia's February 2022 full-scale invasion of Ukraine, noting a single public-facing camera (e.g., a roadside gas-station feed) can provide meaningful operational intelligence with no direct network intrusion required.

Cybersecurity firm Censys independently quantified the exposure in a July 16, 2026 report, building on an earlier Censys camera-exposure blog from March 2026 (published in the aftermath of the Iran conflict, which first flagged the broader trend of adversaries harvesting open camera feeds for military-relevant reconnaissance). The July 2026 Censys analysis found more than 87,000 internet-connected cameras across EU, NATO, and Ukrainian networks running services matching known-exploited vulnerabilities, including CVE-2016-7407 (Dropbear SSH arbitrary code execution via crafted local key-import, publicly known since March 2017) and CVE-2021-39275 (Apache HTTP Server out-of-bounds write / buffer overflow, CVSS 9.8, patched in Apache 2.4.49). Country-level Censys totals: Netherlands 45,386 cameras / 1,992 vulnerable (159 tied to the Dropbear SSH flaw, 112 to the Apache flaw, 541 to other camera-specific bugs); Ukraine 60,487 cameras / 4,097 vulnerable; France 68,317 cameras / 8,977 vulnerable; Germany 65,539 cameras / 8,401 vulnerable; Italy 99,203 cameras / 12,678 vulnerable; Spain 81,371 cameras / 8,685 vulnerable; United Kingdom 113,962 cameras / 7,142 vulnerable; Poland 57,534 cameras / 4,250 vulnerable. Camera brands referenced in vendor fingerprinting discussions of this exposed population include Hikvision, Mobotix, Amcrest, Dahua, Hanwha, and Bosch, though AIVD/MIVD did not attribute the specific breached devices to any one vendor.

AIVD and MIVD state that within the Netherlands they confirmed only a small number of actually-breached cameras, several of which sat directly on military logistics routes; the responsible organizations were notified so the devices could be secured. The agencies did not name a specific Russian service (GRU, SVR, or FSB), stating only that "at least one Russian intelligence service" is responsible, and characterize the operation as collecting intelligence that in some cases is not directly relevant to the war but broadly useful to Russian state interests. Within Ukraine itself, the Dutch services state camera-derived intelligence has been used in attempts to locate and neutralise Ukrainian military personnel and materiel -- i.e., the surveillance has fed into targeting decisions rather than remaining passive collection. No such lethal downstream use has been observed for camera intelligence gathered outside Ukraine to date. AIVD/MIVD recommend camera owners change default credentials, disable UPnP and direct port-forwarding, route remote access through a VPN, enable MFA where supported, mask sensitive fields of view, and consider the geopolitical origin of camera hardware (flagging China, Russia, and Iran as supply-chain risk factors) when procuring devices.

## MITRE ATT&CK

- T1595 Active Scanning
- T1592 Gather Victim Host Information
- T1590 Gather Victim Network Information
- T1588 Obtain Capabilities
- T1583 Acquire Infrastructure
- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1133 External Remote Services
- T1211 Exploitation for Stealth
- T1046 Network Service Discovery
- T1518 Software Discovery
- T1125 Video Capture
- T1119 Automated Collection
- T1005 Data from Local System
- T1074 Data Staged

## Sources

- [Russian Intelligence Hijacks IP Cameras to Monitor Weapons Deliveries to Ukraine](https://cybersecuritynews.com/russian-intelligence-hijacks-ip-cameras/)
- [Russian Intelligence Hacks IP Cameras to Spy on Military Logistics Across NATO States and Ukraine](https://thehackernews.com/2026/07/russian-intelligence-hacks-ip-cameras.html)
- [Dutch Intelligence Warns Russia Uses Hacked IP Cameras for Military Espionage](https://securityaffairs.com/195708/intelligence/dutch-intelligence-warns-russia-uses-hacked-ip-cameras-for-military-espionage.html)
- [Inside Russia's Camera-Hacking Espionage Campaign](https://censys.com/blog/russia-camera-hacking-espionage-campaign/)
- [Russia uses hacked cameras across NATO countries to monitor arms deliveries to Ukraine](https://www.pravda.com.ua/eng/news/2026/07/11/8043531/)
- [Russia Turned Civilian Security Cameras Across Europe Into Spy Network, Intelligence Reveals](https://united24media.com/war-in-ukraine/russia-turned-civilian-security-cameras-across-europe-into-spy-network-intelligence-reveals-20675)
- [Russian spies are peeping through cameras all over Europe, and too many of them are wide open](https://cybernews.com/security/russian-spies-hacking-european-ip-cameras/)
- [Russian Spies Are Hacking Security Cameras to Track NATO Weapons Shipments](https://cyberpress.org/nato-camera-espionage-exposed/)
- [87,000 vulnerable IP cameras in Europe could be exploited by Russian intelligence services -- Censys report](https://mezha.ua/en/news/researchers-identify-87-000-vulnerable-ip-cameras-across-europe-313357/)
- [NVD - CVE-2021-39275](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2021-39275)
- [NVD - CVE-2016-7407](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2016-7407)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1624