[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f4yuLVFDaZzjxNahbLz6XpKISHX4lXkPW44wOW5b6hp8":3},{"article":4,"iocs":44,"watch_terms":52,"solutions":53,"lesson":137},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"9e7706e4-3f57-4c47-aa56-83fca115fbdd","Russian Intelligence Hacks IP Cameras to Spy on Military Logistics Across NATO States and Ukraine","russian-intelligence-hacks-ip-cameras-to-spy-on-military-logistics-across-nato-s-069895","At least one Russian intelligence service is systematically hijacking internet-connected security cameras across Europe and Ukraine, using the feeds to watch military transport routes, weapons shipments bound for Kyiv, and the locations of Ukrainian troops. That is the finding of a cybersecurity advisory published July 10 by the AIVD and MIVD, the Netherlands' civilian and military intelligence","Dutch intelligence (AIVD and MIVD) disclosed that Russian intelligence services are actively compromising internet-connected security cameras across Europe, NATO states, and Ukraine to monitor military logistics, weapons shipments, and troop locations. The attackers exploit default credentials and outdated firmware rather than zero-days, and in Ukraine have allegedly used camera access to target and neutralize military personnel. Censys research found over 87,000 vulnerable cameras across the EU, NATO, and Ukraine, with 4,000+ in Ukraine itself.","Russian intelligence systematically hacks exposed IP cameras across NATO and Ukraine for military surveillance.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F07\u002Frussian-intelligence-hacks-ip-cameras.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEhnZdcdM-XJQ9tmIQw7h4gqSDABg-Ip1mzizMoR9zRcyQmaG7OGlQSp1ad0RsZSflsvdKVn0bs4EXdPthnHgiC76as_RVG-W7vZ88AHvJ2HhCLEaQOlNukhrTl6NSq6sgAHGiGUXemDrbZePvUDIi2oxWb60rRX5lkxA5bsFBJplBkaVQTZ5R0EjOrJTaQ\u002Fs1600\u002Fip-camera-hacking.jpg","2026-07-20T12:13:39+00:00","2026-07-20T14:00:13.568653+00:00",9,[17,20,23,25],{"name":18,"type":19},"Russian Intelligence Service (unspecified)","threat_actor",{"name":21,"type":22},"Dropbear SSH","vendor",{"name":24,"type":22},"Apache",{"name":26,"type":27},"IP Cameras","technology","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":28,"icon":30,"name":31,"slug":32},null,"Nation-state","nation-state",[34,39],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"d6f63bb8-0801-486a-be7f-171400700454","IoT\u002FOT","iot-ot",{"category":40},{"id":41,"icon":30,"name":42,"slug":43},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[45,49],{"type":46,"value":47,"context":48},"cve","CVE-2016-7407","Local key-import vulnerability in Dropbear SSH server found on 159 Dutch IP cameras; patched July 2016.",{"type":46,"value":50,"context":51},"CVE-2021-39275","Out-of-bounds write in Apache 2.4.48 and earlier, found on 112 Dutch IP cameras; patched in 2.4.49.",[21,24],{"controls":54,"vendors":130},[55,84,109],{"slug":56,"name":57,"problem":58,"products":59},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[60,68,76],{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":85,"name":86,"problem":87,"products":88},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[89,94,101],{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":90,"product_name":91,"url":92,"description":93},"axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":96,"url":99,"description":100},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"slug":110,"name":111,"problem":112,"products":113},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[114,122],{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",[131],{"slug":132,"name":133,"logo_path":134,"roles":135},"censys","Censys","\u002Fvendor-logos\u002Fcensys.png",[136],"reported_by",{"slug":138,"title":139,"body":140,"framework_refs":141,"framework_notes":154},"russian-intelligence-exploits-default-credentials-and-outdated-firmware-in-ip-cameras-to-surveil-nat","Russian Intelligence Exploits Default Credentials and Outdated Firmware in IP Cameras to Surveil NATO Military Logistics","Russian intelligence services are actively compromising internet-connected IP cameras across NATO states and Ukraine by exploiting two fundamental security failures: default credentials that were never changed and outdated firmware that was never patched. These are not sophisticated zero-day attacks — they are entirely preventable hygiene failures that have had life-threatening consequences, including the alleged targeting of military personnel in Ukraine. With over 87,000 vulnerable cameras identified across the EU and NATO, this represents a massive, systemic exposure of critical surveillance infrastructure to adversarial nation-state actors. The case underscores that IoT and physical security devices are often the weakest link in an organization's network, frequently overlooked in standard patch and configuration management cycles.",[142,143,144,145,146,147,148,149,150,151,152,153],"CIS Control 1: Inventory and Control of Enterprise Assets","CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","NIST SP 800-82: Guide to ICS\u002FOT Security","NIST AC-2: Account Management","NIST AC-17: Remote Access","NIST SI-2: Flaw Remediation","NIST CM-6: Configuration Settings","NIST IR-4: Incident Handling","ETSI EN 303 645: Cyber Security for Consumer IoT","GDPR Article 32: Security of Processing (for cameras capturing personal data)",{}]