A Russian intelligence service is systematically compromising internet-connected security cameras across Europe and Ukraine. The objective: to monitor military transport routes, track **weapons shipments bound for Kyiv**, and pinpoint the locations of Ukrainian troops. This alarming finding comes from a cybersecurity advisory published on July 10 by the **AIVD** and **MIVD**, the Netherlands' civilian and military intelligence services. They describe the operation as ongoing and widespread. In Ukraine, the surveillance has escalated beyond passive observation. Camera access has been "used in attempts to neutralise Ukrainian military personnel" and destroy their equipment, effectively turning exposed roadside or business cameras into targeting aids. Across **EU** and **NATO** states, the same compromised cameras are also collecting military intelligence unrelated to the ongoing conflict. Entry into these systems is often alarmingly simple. Operators scan the internet for exposed devices, fingerprint **IP cameras** by brand, and exploit devices still running default passwords, obsolete firmware, or factory settings that have not been changed. Crucially, none of the access described in the advisory required zero-day vulnerabilities. From there, image-recognition software automates the surveillance, running searches through video feeds for military vehicles and their cargo. ## Just How Exposed Are These Cameras? Being reachable from the internet does not automatically equate to being hacked. "Having a camera publicly accessible doesn't make it hackable," notes **Martijn Grooten**, a principal security researcher at **Censys**, the internet-scanning firm, in their own analysis of the exposed surface. However, the scale of exposure is enormous. Across the EU, NATO members, and Ukraine, Censys identified over 87,000 internet-connected cameras running a service version known to match an exploited vulnerability. This figure, which Censys considers a lower bound, includes more than 4,000 such cameras in Ukraine alone.  Censys's count includes hosts running any vulnerable service, not just cameras with inherent software flaws. In the Netherlands, Censys found 45,386 publicly accessible cameras, with 1,992 flagged for running a service with a known-exploited vulnerability. When narrowing the focus to vulnerabilities within the camera software itself, the number drops to 541. Censys maintains the broader count, arguing that a foothold on one service can often lead to a takeover of the entire host. These version matches come with caveats. A service banner does not always confirm a reachable exploit. For instance, **CVE-2016-7407**, found in `dropbearconvert` within the **Dropbear SSH** server, is a local key-import tool that executes code only when a malicious key file is converted. It was patched in July 2016, yet Censys flagged 159 Dutch hosts for it. **CVE-2021-39275**, an out-of-bounds write vulnerability in **Apache**, is rated low by Apache itself, as no bundled module feeds untrusted data to the affected function, though a third-party module might. It was patched in Apache 2.4.49 in 2021, with 112 Dutch hosts running a matching version. While Censys counts both as exploited in the wild, neither is listed in **CISA's Known Exploited Vulnerabilities** catalog. Despite the vast exposed surface, the Dutch services, in a separate statement, confirmed only a small number of cameras were actually breached. These were strategically located along military logistics routes within the Netherlands, and the affected organizations have since been notified to secure their systems.  ## What Defenders Should Do The recommended countermeasures are practical and effective: * **Identify Exposed Assets**: Locate cameras reachable from the public internet via forgotten port forwards, **UPnP** mappings, or vendor cloud relays. Prioritize those overseeing transport routes, ports, and other sensitive locations, and audit their logs for unrecognized access. * **Isolate Video Streams**: Disable port forwarding and UPnP. Access cameras securely through a **VPN**. * **Strengthen Authentication**: Replace default credentials immediately and enable **MFA** where supported. If MFA is unavailable, ensure the camera is entirely removed from public internet access. * **Strategic Aiming**: Deliberately angle camera lenses to avoid capturing logistics routes, loading docks, and other sensitive areas. Mask unavoidable sensitive views. * **Maintain and Upgrade**: Regularly patch firmware and software. When purchasing new equipment, prioritize cameras with extended security support, not just a few months. The intelligence services have not observed camera-derived intelligence being used for military attacks outside Ukraine. The portability of this threat lies in its simplicity: entry often requires only a default login, and its value is determined by what the camera happens to oversee. A compromised camera provides an adversary with real-time intelligence on physical operations—truck movements, personnel comings and goings—without requiring a deeper network breach. The solution, therefore, extends beyond merely patching the device; it involves isolating it from the public internet and carefully controlling its field of vision.