Russia Turns IP Cameras on NATO Arms

A cheap security camera fixed to a warehouse wall somewhere in Europe, still using its factory password, was quietly taken over by Russian state hackers and added to a surveillance network tracking weapons shipments to Ukraine. Its owner may never know. Dutch intelligence services disclosed the operation earlier this month, saying IP cameras across NATO countries had been compromised along military logistics routes (AIVD, DW).

For Malta, this is not a distant northern European problem. A country that runs ports, financial services, gaming platforms and public administration through dense digital systems cannot treat weak devices as small housekeeping failures. European governments are now saying openly what security people have been warning for years: Russian cyber operations against civilian infrastructure are not occasional incidents. They are continuous.

Finnish authorities call it arkipäivää, everyday life, a permanent background condition (Yle). NATO used similar language on 13 July when it condemned Russia’s "persistent malicious cyber activities" (NATO). This is not one breach to investigate, clean up and close. It is a standing operation that states and companies now have to live with and resist.

Copying every key in the building

The old image of a cyberattack is a burglary: someone breaks in, takes something and leaves. What European agencies are describing is closer to someone copying every key in the building, learning the guard’s routine, mapping delivery routes and occasionally pulling a fire alarm to see how fast everyone reacts.

The entry point is often ordinary. An old router. A weak password. A device that nobody in the office has updated in years. Finland’s intelligence service, Supo, says Russia’s FSB 16th Centre uses precisely these openings to spy on energy and defence companies (Supo). No glamorous technology is needed.

The strategic value comes after entry. Attackers steal login credentials, effectively copied keys, then move from one system to another: from reception to the storeroom, then to the control room. They watch internal communications, learn how an organisation works and keep access open for months or years.

Espionage maps the terrain. Floods of junk traffic that knock websites offline create noise. Destructive malware can sit quietly until escalation is useful (ENISA). In a small state like Malta, where a limited number of suppliers often serve government, finance, gaming and logistics, that kind of access can matter quickly.

Different countries, same campaign

Each country sees the threat through its own exposure. Finland’s story is about the edge of networks: energy and critical-sector companies targeted for long-term espionage. Foreign Minister Elina Valtonen condemned the activity and summoned Russia’s ambassador (MTV Uutiset).

Poland’s story is about logistics. As a main transit route for support to Ukraine, it faces cyber operations alongside physical sabotage. Foreign Minister Radosław Sikorski warned of credible intelligence that Russia was planning further actions, referring to arson, railway attacks and infrastructure reconnaissance together with digital intrusions (RMF24, Rzeczpospolita).

These are not competing accounts. They are different exposed sides of the same campaign: steal access, watch networks, map dependencies, disrupt selectively and raise the cost for states supporting Ukraine.

There is one necessary caution. Some of these warnings rely on classified intelligence that governments cannot publish. Attribution here means official assessment, not evidence tested in open court. The Polish foreign ministry cited an EU position linking destructive operations to the FSB 16th Centre (WP). That is plausible and institutionally backed, but not fully auditable from the outside.

Laws are ready, routers are not

Europe’s legal response has moved quickly. The two main instruments, the NIS2 Directive and the Cyber Resilience Act, try to push responsibility upwards: away from an overwhelmed IT desk and onto company boards and device manufacturers (NIS2 Directive).

NIS2 makes senior management legally accountable for cybersecurity and tightens incident reporting across more sectors. The Cyber Resilience Act goes directly at the camera-and-router problem, requiring manufacturers to ship products with proper security defaults rather than factory passwords (EUR-Lex CRA).

The gap is implementation. A directive cannot instantly patch every old router in a warehouse, hotel, office or kunsill lokali. It cannot replace every default password sitting inside a device bought years ago and forgotten. NIS2 transposition remains uneven across member states. The architecture is sound. The wiring is incomplete.

For European citizens, and certainly for Maltese businesses, the shift is as much conceptual as technical. Cybersecurity is no longer emergency cleanup after a spectacular breach. It is infrastructure maintenance: constant detection, patching, supplier oversight and incident response.

That is less dramatic than a single headline attack, but harder to sustain. The next test will not be whether Europe has the right laws on paper. It will be whether old cameras, unpatched routers and undertrained company boards have changed before Russia uses access it has already built.