Russia hijacks IP cameras to track NATO arms

A security camera bolted to a warehouse wall. It watches a loading dock, a stretch of road, maybe a gate. Its owner installed it to deter package theft or check on deliveries. But if that road happens to carry military trucks bound for Ukraine, the camera has a second audience.

Dutch intelligence services AIVD and MIVD disclosed this month that at least one Russian intelligence service compromised internet-accessible cameras across Europe to monitor military logistics. The hijacked feeds were used to identify military vehicles, cargo, transport routes, weapons deliveries to Ukraine, and locations of Ukrainian military personnel (AIVD). A small number of cameras sitting directly on military logistics routes in the Netherlands were confirmed compromised, and the owners were warned (NL Times).

A burglar who borrows your windows

The method is simpler than it sounds. Attackers scan the open internet for devices that should never have been reachable from outside: cameras still using the factory password they shipped with, running old software that hasn't been patched, or left open to remote connections the owner never configured. Once inside, they don't need to install anything. The camera already does the hard work: it points at the world and streams video (AIVD advisory PDF, Security Management).

Think of it as a burglar who never enters your house but uses every poorly locked window in the neighbourhood as a lookout post. Each camera shows only a small fragment: a stretch of highway, a rail siding, a port entrance. Stitch enough fragments together, and you can reconstruct the rhythm of a supply chain. When a convoy passed, in which direction, how often, what type of vehicle (Intelnews). In a war defined by logistics, that timing data is intelligence.

What makes this more useful than satellite imagery is proximity. A roadside camera captures close-range detail that orbiting sensors miss: vehicle markings, escort patterns, loading activity. The Dutch advisory mentions automated image recognition, meaning software that can scan video for vehicle shapes, markings or repeated movement patterns so that humans don't have to watch every feed. That allows processing at scale, across dozens or hundreds of compromised cameras at once.

The weak-device pattern is spreading

The Netherlands is not an isolated case. Finland issued a parallel warning days later, though the Finnish problem centres on routers and enterprise network devices rather than cameras. Finnish intelligence warned companies that Russian FSB-linked actors exploit poorly protected network equipment to reach companies, critical infrastructure and the defence industry (Supo, Kyberturvallisuuskeskus). The mechanism is the same: cheap, poorly secured devices become entry points. Finland, a NATO member with a 1,340-kilometre Russian border, is treating weak connected devices as a national-resilience issue.

Poland matters because much of Ukraine's military supply chain crosses its territory. Allied governments had already warned that Russian military hackers target logistics firms involved in Ukraine support (NCSC, Kresy). German media flagged the story too, though the current evidence chain runs through Dutch sources rather than a separate German intelligence finding (Focus).

Precision matters here because the public evidence is narrower than the headlines. Many outlets described "hacked doorbell cameras" along NATO routes. The official Dutch documents refer to IP cameras. Doorbells, specific brands and detailed route maps appear in media retellings, not in the published advisory (AIVD advisory PDF). The confirmed facts are serious enough without embellishment.

Who fixes this?

The Dutch advisory offers straightforward fixes for device owners: change default passwords, disable unnecessary remote access, update the camera's software, use encrypted connections, and limit what the camera can see. A perfectly secured camera that needlessly overlooks a military loading zone still creates risk if compromised later (AIVD advisory PDF).

But a homeowner cannot solve what is structurally a state-level problem. Only governments can map which civilian cameras sit along sensitive corridors, warn their owners, set procurement standards, and coordinate reducing what can be seen along logistics routes. Dutch services did exactly that for the cameras they identified. Whether other NATO members are doing the same is an open question.

Europe's military supply chain does not float above society. It travels through commercial roads, civilian ports, private warehouses, and streets lined with cheap, internet-connected sensors. That gives NATO depth and flexibility. It also means the civilian fabric that makes logistics resilient makes logistics visible, one forgotten default password at a time.