Russian hackers breached cameras on NATO logistics routes to track weapons shipments

Russian state-backed hackers have been systematically compromising internet-connected civilian IP cameras in NATO countries across Europe in an effort to monitor the transfer of military equipment and weapons to Ukraine.

Source: joint statement by the Dutch General Intelligence and Security Service (AIVD) and the Military Intelligence and Security Service (MIVD)

Details: According to the intelligence agencies, the large-scale Russian operation targeted cameras located along military logistics routes in Europe, including in the Netherlands. The hackers were attempting to identify what types of weapons were being sent to Ukraine.

During the joint investigation, the agencies found that a small number of cameras located directly on military logistics routes in the Netherlands had been compromised. The organisations that own these devices have since been notified and are taking appropriate security measures.

The intelligence services noted that the Netherlands is a key target for Russian espionage because of its role as a transit country and its substantial military support for Ukraine.

The investigation also found that most of the compromised IP cameras had poor security, including default passwords, outdated software and factory settings.

Many of the affected devices were inexpensive Chinese-made Hikvision or Dahua cameras, including smart doorbell systems that homeowners and businesses use for security. In most cases, the owners were unaware that their cameras had been hacked.

Background:

• Since 2022, Russian state-sponsored hackers have conducted large-scale cyberattacks against logistics and technology companies involved in delivering international assistance to Ukraine. In 2025, the Cybersecurity and Infrastructure Security Agency (CISA) of the US Department of Homeland Security reported that at least 13 NATO member states and Ukraine had been targeted by Russian cyberattacks.
• Ukrainian hackers have also previously taken control of Russian surveillance cameras to monitor Russian troop movements and help guide long-range strikes. This method was successfully used during the first operation in which a Ukrainian Uncrewed Surface Vessel (USV) struck a Russian submarine in the port of Novorossiysk.
• Israeli security services have previously warned that Iran used IP cameras to identify targets during large-scale drone and missile attacks on Israel.
• Meanwhile, Israeli intelligence services and the CIA had infiltrated networks of security and traffic cameras across Tehran, enabling them to locate Iran's former Supreme Leader Ali Khamenei before conducting aerial strikes that killed him on the first day of the war.

Support Ukrainska Pravda on Patreon to help us keep reporting!