Allied Intelligence — 2026-07-24

Dutch Intelligence Agencies Warn Russian State Actors Systematically Compromising IP Cameras Across NATO States for Military Espionage

BLUFRussia's exploitation of default-credential IP cameras will likely persist over the coming months as a scalable, low-cost military logistics tracking capability that NATO's fragmented patching governance cannot close at speed.

The Netherlands' AIVD and MIVD published a joint cybersecurity advisory on July 10 warning that at least one Russian intelligence service is systematically compromising internet-connected IP cameras across the Netherlands, other EU and NATO member states, and Ukraine 1. The Russian service uses automated image recognition software to search camera feeds for military vehicles and cargo, mapping EU and NATO military transport routes and weapons deliveries to Ukraine 12. In Ukraine, camera access has been used in attempts to locate and target Ukrainian military personnel and destroy their equipment, according to the advisory 1. Internet intelligence firm Censys identified more than 87,000 exploitable internet-connected cameras across EU, NATO, and Ukrainian territory, including over 4,000 in Ukraine and nearly 2,000 in the Netherlands, many vulnerable through default passwords or outdated firmware such as a Dropbear SSH flaw known since 2017 2. The Dutch services assessed that Russia's digital espionage operations to support military operations have increased systematically since the start of the war in Ukraine 1.

Analysis
Default-password cameras require no zero-day exploits, turning bulk access via automated image recognition into a near-real-time military logistics tracking system across an 87,000-camera attack surface that individual organizations patch slowly if at all; the capability likely persists across NATO states over the coming months given the exposure size and patching inertia. Moderate confidence reflects the AIVD's direct attribution to a named Russian intelligence service combined with independent Censys quantification of the exposure, though the advisory does not identify the service or disclose confirmed compromises beyond the Netherlands, and the 87,000 figure measures vulnerability rather than confirmed access, which may concentrate on cameras positioned along logistics routes rather than spanning the full surface. Sourcing rests on the AIVD/MIVD advisory as the sole primary document, with Censys scale data added independently. Persistent exploitation leaves NATO logistics planners exposed on military transport routes unless camera hardening accelerates, which would strip Russia of a low-cost persistent surveillance capability.

4 sources

Russian cyber espionage campaign exploits insecure IP cameras in Europe and Ukraine, Dutch agencies say - Industrial Cyber
Russian Intelligence Hacks IP Cameras to Spy on Military Logistics Across NATO States and Ukraine - The Hacker News
Russian Intelligence Hijacks IP Cameras to Monitor Weapons Deliveries to Ukraine - Cyber Security News
Cybersecurity Advisory: Russian State Actors Are Compromising IP Cameras - AIVD/MIVD