Russian spies are hijacking Europe's security cameras to watch weapons move to Ukraine

Key points

• Dutch civilian and military intelligence services published a joint advisory on 10 July warning that Russian spies are hijacking internet-connected security cameras.
• The hijacked feeds are being used to watch weapons shipments heading to Ukraine and the movements of Ukrainian forces.
• The campaign spans multiple European countries and Ukraine itself, targeting ordinary CCTV cameras exposed to the internet.
• Dutch agencies AIVD and MIVD attribute the activity to at least one Russian intelligence service.
• Owners of internet-connected cameras near ports, rail hubs, borders or military sites face the greatest exposure.

Russian spies aren't just breaking into email accounts anymore. They're watching the roads.

That's the blunt finding of a joint advisory published on 10 July by the AIVD, the Netherlands' civilian intelligence agency, and the MIVD, its military counterpart. At least one Russian intelligence unit is systematically hijacking internet-connected security cameras across Europe and inside Ukraine, then using the live feeds to spy on the war effort. The advisory was surfaced by The Hacker News.

What are the Russians actually looking at?

Military transport routes, weapons shipments bound for Kyiv, and the positions of Ukrainian forces. Think of the camera bolted to the outside of a small port office or a warehouse near a border crossing. Many devices are plugged straight into the internet so the owner can check them remotely. That same connection is what the attackers are abusing.

Once inside, the spies don't need to plant a device or send an agent. They just watch. A convoy of military lorries rolling past a filling station in eastern Poland at 3am tells Moscow a great deal. Our 17 July story on the data pipes feeding autonomous weapons made a similar point: the sensors and feeds around defence logistics are outpacing the security wrapped around them.

How are they getting into the cameras?

The advisory points at familiar weaknesses that plague small internet-connected devices.

Many CCTV cameras ship with a default username and password printed in the manual, and owners rarely change them. Others run old firmware with known bugs the manufacturer has since patched, but the fix was never installed. Some sit exposed to the open internet with no firewall in front of them.

This isn't a zero-day, meaning a brand-new flaw nobody knew about. It's opportunism at industrial scale: scan the internet, find cameras that respond, try common credentials, log in. Multi-factor authentication (a second login step such as a code from your phone) isn't even offered on most of these devices. That's a structural gap no advisory can patch overnight.

Should ordinary people be worried?

If your home doorbell camera points at your front garden in Rotterdam, you're not the target.

The risk sits with businesses and public sites that overlook something militarily interesting: ports, rail yards, motorways near bases, border posts, logistics depots. A few practical steps close most of the gap. Change the default password on every camera. Put devices behind a firewall or a VPN, which is a private tunnel that hides them from the open internet. Update the firmware. Disable remote access you don't use.

Why this matters beyond Ukraine

Camera hijacking is cheap, quiet and hard to notice. There's no ransom note. The lights stay green, and the owner has no reason to suspect anything until an intelligence service says so.

This also fits a broader Russian pattern. The SSU and FBI detailed a GRU and FSB-linked phishing campaign against Signal and Telegram accounts back in June, and the methods are consistent: low-cost, persistent access that prioritises observation over disruption.

Expect this playbook to spread. Any conflict, any sensitive site with a webcam pointed at it, is now fair game.