# Royal Navy K3 Scout Drone Cameras Found Transmitting Heartbeat Signals to China-Based IP Address

> A routine Ministry of Defence cyber vulnerability assessment found that third-party cameras fitted to Royal Navy Kraken K3 Scout unmanned surface vessels (USVs) — used by 47 Commando and the Special Boat Service since March 2026 under Project Beehive — were sending periodic 'heartbeat' status pings to an IP address located in China. The MoD and manufacturer Kraken Technology Group say an investigation found no evidence that sensitive data or systems were accessed, compromised, or transmitted externally, and internet connectivity to the affected cameras has since been removed.

- **Published:** 2026-08-10T00:00:00Z
- **Last reviewed:** 2026-08-10T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1975
- **ID:** TL-2026-1975
- **Severity:** MEDIUM
- **Category:** SUPPLY_CHAIN
- **Status:** TRACKING
- **Detections:** 9 · **IOCs:** 15 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2026-08-09 The Telegraph reported, and The Register and multiple outlets corroborated on 2026-08-10, that a routine cyber vulnerability sweep of Royal Navy unmanned surface vessels identified third-party electro-optical (EO) camera components transmitting automated 'heartbeat' signals — basic online/functioning-normally status pings, not operational imagery or sensor data — to an IP address located in China. The affected platform is the Kraken Technology Group K3 Scout USV: an 8.4m composite-hulled autonomous vessel with a 1.93m beam, 0.8m draft, 2,500kg maximum displacement, 600kg payload capacity, inboard diesel powertrain with stern drive, 55-knot top speed, 650nm range at 25 knots, up to 30-day mission endurance, Auterion-based autonomy stack, and operating modes spanning supervised autonomous navigation to remote piloting. A 20-vessel, roughly £12.3 million K3 Scout fleet was acquired under the Royal Navy's Project Beehive programme as an open-architecture testbed combining autonomous units with conventional warships, and has been in service with the Coastal Forces Squadron and 47 Commando Royal Marines, including the Special Boat Service at Poole, since around March 2026, used for ISR, surveillance, training, and NATO trials. Reporting also notes the platform was included in a proposed UK defense package for Strait of Hormuz freedom-of-navigation operations, adding operational stakes to the unresolved provenance question.

The cameras were sourced by Kraken from a third-party supplier that had provided assurances of US National Defense Authorization Act (NDAA) compliance; Kraken subsequently confirmed the cameras 'had been presented as compliant with US National Defense Authorization Act requirements,' but that 'a small number of components originat[ed] from outside the UK' — i.e. China-origin components embedded in hardware marketed as NDAA-compliant and British-supplied, despite the supplier's assurances. Reporting also noted that some cameras remained network-active and continued to beacon even while the host vessel itself was powered off, indicating the telemetry capability operates independently of the vessel's own power/operating state — consistent with a firmware-level implant in the camera's component firmware rather than a vessel-software-layer issue (Neowin's coverage headlined the finding as 'firmware sending data back to China'; the MoD itself distinguished the issue as 'communications generated by the camera subsystem rather than the vessels themselves').

Following discovery, the MoD removed all internet connectivity from the affected camera subsystem and launched a formal audit. Both the MoD ('a thorough investigation found no evidence of MoD data or systems being accessed, compromised or transmitted externally') and Kraken ('after a full audit... we are confident no sensitive information has ever been shared outside intended channels') state no sensitive data or systems were compromised; no platform withdrawal was initiated and the K3 Scout fleet remains in service. The incident has drawn both political and diplomatic reaction: Shadow Security Minister Alicia Kearns said 'if we cannot say with confidence what is inside our own military equipment, we cannot say it is ours,' and Conservative MPs called for an urgent audit of UK defense equipment for 'hidden Chinese footprints'; the Chinese Embassy in the UK publicly disputed the reporting, stating that unnamed parties in the UK 'had always tried to distort the facts and create a so-called spying case to tarnish China's reputation.' No CVE has been assigned; this is a hardware/firmware supply-chain provenance issue rather than a disclosed, exploitable software vulnerability, and the exact China-based destination IP address, its ASN/hosting provider, and the underlying camera chipset/OEM have not been publicly disclosed by any outlet as of this writing.

## MITRE ATT&CK

- T1195.003 Compromise Hardware Supply Chain
- T1199 Trusted Relationship
- T1542.005 TFTP Boot
- T1036 Masquerading
- T1082 System Information Discovery
- T1119 Automated Collection
- T1071 Application Layer Protocol
- T1583.004 Server
- T1587.001 Malware

## Sources

- [Cyber vulnerability sweep picks up Royal Navy drones sending data to China](https://www.theregister.com/edge-and-iot/2026/08/10/cyber-vulnerability-sweep-picks-up-royal-navy-drones-sending-data-to-china/5285430)
- [British Royal Navy K3 Scout Drones Supporting Special Forces Found Communicating With China](https://www.armyrecognition.com/news/navy-news/2026/british-royal-navy-k3-scout-drones-supporting-special-forces-found-communicating-with-china)
- [Spy cameras on Navy drones secretly sent data to China](https://www.aol.com/articles/spy-cameras-navy-drones-secretly-201601000.html)
- [Royal Navy Faces Security Questions After £12M Drones Sent Data to China](https://www.ibtimes.co.uk/royal-navy-security-concerns-chinese-data-links-1813292)
- [Royal Navy's K3 Scout vessel had firmware sending data back to China](https://www.neowin.net/news/royal-navys-k3-scout-vessel-had-firmware-sending-data-back-to-china/)
- [British Navy Drone Cameras Sent Signals to China](https://www.yahoo.com/news/world/articles/british-navy-drone-cameras-sent-011026867.html)
- [Unmanned Surface Vehicle (USV) – K3 Scout](https://krakentechnology.com/platforms/k3-scout)
- [SOF Week 2025: Kraken Technology group debuts K3 Scout USV in North America](https://www.shephardmedia.com/news/uv-online/sof-week-2025-kraken-technology-group-debuts-k3-scout-usv-in-north-america/)
- [Special Forces boats fitted with drones that 'secretly sent data to Beijing'](https://www.chinatechnews.com/2026/08/10/126989-special-forces-boats-fitted-with-drones-that-secretly-sent-data-to-beijing)
- [UK's Royal Navy sea drones contain component that secretly sent data to China, report claims](https://www.tomshardware.com/tech-industry/drones/uks-royal-navy-sea-drones-contain-component-that-secretly-sent-data-to-china-report-claims-government-cuts-camera-connectivity-and-insists-data-wasnt-sensitive-only-heartbeat-communications)
- [UK Royal Marines Drones Found Using Chinese Cameras That Connected to Servers in China, Raising Security Concerns](https://www.ssbcrack.com/2026/08/uk-royal-marines-drones-found-using-chinese-cameras-that-connected-to-servers-in-china-raising-security-concerns.html)
- [British Navy Drone Camera Reportedly Sent Data to China](https://voi.id/en/amp/588927)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1975