Russia hijacks IP cameras to track NATO arms

A cheap security camera on a European warehouse wall, still running its factory password, was quietly hijacked by Russian state hackers and folded into a surveillance network tracking weapons shipments to Ukraine. The camera's owner may never know. Dutch intelligence services revealed the operation earlier this month, describing how IP cameras across NATO countries had been compromised along military logistics routes (AIVD, DW). That image captures something European governments are now saying openly: Russian cyber operations against civilian infrastructure are not occasional incidents. They are continuous.

Finnish authorities describe it as "arkipäivää," everyday life, a permanent background condition (Yle). NATO, condemning Russia's "persistent malicious cyber activities" on 13 July, used language that points the same way (NATO). This is not one breach to investigate and close. It is a standing operation to endure.

Copying every key in the building

The old mental image of a cyberattack is a burglary: someone breaks in, takes something, leaves. What multiple European agencies are now describing looks more like someone copying every key in a building, learning the guard schedule, mapping delivery routes and occasionally pulling a fire alarm to time the response.

The entry point is often boring: an old router, a weak password, a device nobody has updated in years. Finland's intelligence service, Supo, says Russia's FSB 16th Centre uses exactly those openings to spy on energy and defence companies (Supo). No exotic tools required.

What makes this strategically serious is what happens after entry. Attackers steal login credentials (copied keys), then use them to move from one system to another, from the lobby into the storage room, then the control room. They monitor internal communications, map how the organisation works, and maintain their access for months or years. Espionage maps the terrain. Floods of junk traffic that crash websites create noise. Destructive malware stays dormant, available if escalation is wanted (ENISA).

Different countries, same campaign

Each country sees the threat through its own exposure. Finland is a network-edge story: companies in energy and critical sectors are targets for long-term espionage. Foreign Minister Valtonen condemned the activity and summoned Russia's ambassador (MTV Uutiset). Poland is a logistics-corridor story: as a primary transit route for Ukraine support, it faces cyber operations alongside physical sabotage. Foreign Minister Sikorski warned of credible intelligence that Russia was planning further actions, listing arson, railway attacks and infrastructure reconnaissance in the same breath as digital intrusions (RMF24, Rzeczpospolita).

These are not contradictory accounts. They are different surfaces of the same campaign: steal access, watch networks, map dependencies, disrupt selectively and impose costs on states supporting Ukraine.

A caveat: some warnings rest on classified intelligence governments cannot publish. Attribution is official assessment, not public courtroom evidence. The Polish foreign ministry cited an EU position linking destructive operations to the FSB 16th Centre (WP). Plausible and institutionally backed, but not fully auditable.

Laws are ready, routers are not

Europe's legal response has moved fast. The core idea behind the two main instruments, the NIS2 Directive and the Cyber Resilience Act, is to push responsibility upward: away from an overwhelmed IT desk and onto company boards and device manufacturers (NIS2 Directive). NIS2 makes senior management legally accountable for cybersecurity and tightens incident reporting across more sectors. The Cyber Resilience Act targets the source of the camera and router problem directly, requiring manufacturers to ship products with proper security defaults instead of factory passwords (EUR-Lex CRA).

The gap is implementation. A directive cannot instantly patch every old router or replace every default password. NIS2 transposition remains uneven across member states. The architecture is sound. The wiring is incomplete.

For European citizens, the shift is conceptual as much as technical. Cybersecurity is no longer emergency cleanup after a spectacular breach. It is infrastructure maintenance: continuous detection, patching, supplier oversight, incident response. Less dramatic than a single headline attack, but harder to sustain. The next test will not be whether Europe has the right laws on paper. It will be whether old cameras, unpatched routers and undertrained company boards have actually changed before Russia uses the access it has already built.