Russian intelligence has been spying on Nato military bases through civilian internet-connected cameras, using hacked devices to monitor the transfer of military equipment to Ukraine, Dutch intelligence services said in a joint investigation.
Get breaking news anytime, anywhere. Download the TOI app now!
The AIVD domestic security and MIVD military intelligence agencies said they uncovered a "large-scale Russian operation" targeting cameras along military transport routes in European Nato member states, including the Netherlands and Ukraine. Organisations with cameras on these routes have been warned and advised to take action.
The investigation found that many compromised devices lacked basic security protections, often relying on default passwords, outdated firmware and standard factory configurations. Hackers used readily available apps to scan for accessible cameras and infiltrate them.
Camera hacking and modern warfare
The Dutch revelation fits a broader pattern of camera hacking in modern warfare. Ukrainian hackers have hijacked Russian surveillance cameras to monitor troop movements and direct long-range strikes, including during the first known use of an undersea drone against a Russian submarine in Novorossiysk.
Israeli spies and the CIA also infiltrated a network of security and traffic cameras across Tehran to locate former Supreme Leader Ali Khamenei before launching the strikes that killed him on the first day of the Iran war, according to previous reports.
The practice is now considered easier and cheaper than using drones or satellites. Ground-based cameras provide a unique ground-level view of terrain that aerial intelligence cannot match.
Dutch authorities warn organisations
The AIVD and MIVD released a cybersecurity advisory urging organisations with internet-connected cameras to update software, change default passwords and review device configurations to reduce the risk of unauthorised access.
The alert comes after Dutch authorities dismantled infrastructure linked to pro-Russian cyber operations by seizing 800 servers from two hosting providers allegedly used to support attacks across Europe.
