Dutch intelligence confirms an ongoing Russian campaign to hijack civilian-owned cameras and track weapons bound for Ukraine.
Intelligence Lead
The Netherlands' civilian and military intelligence services have confirmed that a Russian state intelligence unit is systematically hijacking privately owned, internet-connected security cameras across the Netherlands, other NATO and EU member states, and Ukraine to monitor military logistics. The operation gives Moscow real-time visibility into the routes, timing, and cargo of NATO weapons shipments to Kyiv, and in Ukraine has reportedly been used to help locate military personnel and equipment for targeting.
Situation Report
On 10 July, the AIVD (General Intelligence and Security Service) and MIVD (Military Intelligence and Security Service) issued a joint cybersecurity advisory describing an active, ongoing campaign in which Russian operators compromise internet-facing IP cameras, many of them inexpensive Chinese-manufactured Hikvision and Dahua units and consumer smart doorbells owned by private businesses and homeowners. The advisory assesses that the affected devices are concentrated along transportation corridors frequented by NATO convoys moving materiel toward Ukraine.
Access to compromised feeds reportedly allows Russian intelligence to confirm which roads are in active use, identify vehicle types and cargo signatures, and build a pattern-of-life picture of logistics timing. Dutch officials describe the exploited devices as suffering from baseline security failures, default administrator credentials, unpatched firmware, and factory configurations left unchanged by owners unaware their hardware sat astride a strategic corridor.
The two services state the targeting extends beyond the Netherlands to other NATO member states and to Ukraine itself. Inside Ukraine, camera access has reportedly been used in attempts to locate and strike military personnel and equipment, converting an ordinary roadside or storefront camera into a targeting node. Corroborating reporting from The Record, The Hacker News, and Dutch outlets NL Times and DutchNews.nl aligns with the AIVD/MIVD advisory on scope and method, though public attribution to a specific Russian service (GRU, SVR, or FSB-linked) remains unconfirmed in open sources.
Dutch authorities have not disclosed the total number of compromised devices or issued a public list of affected operators, citing the sensitivity of an active mitigation effort.
Background & Context
The operation sits inside a broader pattern of Russian hybrid activity against European logistics supporting Ukraine that has intensified through 2026, spanning rail sabotage, undersea cable interference, and GPS jamming across the Baltic and North Sea. Unlike those kinetic or electronic-warfare methods, camera hijacking exploits a passive, low-cost attack surface: the consumer and small-business IoT ecosystem that has proliferated with minimal security oversight across Western Europe.
The tactic echoes a long-standing Russian intelligence preference for repurposing dual-use, commercially available infrastructure rather than deploying bespoke tools that carry higher operational and attributional risk. Compromising an existing camera network requires neither physical access nor novel malware sophistication, only patient exploitation of known credential and firmware weaknesses, which lowers the bar for scale and deniability.
This also lands amid sustained scrutiny of Chinese-manufactured surveillance hardware's security posture in Western markets, a debate previously centered on data-privacy and supply-chain concerns that now acquires a direct military-logistics dimension.
Analysis & Assessment
The operation illustrates how the exposed edge of civilian IoT infrastructure has become a de facto contested domain in the Ukraine support effort, one that sits outside traditional military network defenses and largely outside the regulatory reach of NATO cyber-defense coordination. Assessed with high confidence given the joint, on-record AIVD/MIVD advisory and consistent independent corroboration, though the precise scale of the camera network and the specific perpetrating service remain moderate-confidence judgments pending further attribution.
The likely trajectory is twofold. First, expect additional NATO states to disclose similar findings as they audit exposed camera infrastructure along their own logistics corridors, a process the Dutch advisory itself may accelerate by prompting allied services to check comparable device inventories. Second, expect renewed pressure toward mandatory security baselines for consumer IoT devices sold in the EU, an issue regulators have circled for years without decisive action; a documented military-targeting nexus changes the political calculus.
For Ukraine specifically, the targeting dimension, camera access allegedly supporting strikes on personnel and equipment, represents an escalation beyond passive logistics monitoring and should be read as part of Russia's broader effort to compress the sensor-to-shooter timeline using any accessible data source, however unconventional.