“Having a camera publicly accessible doesn't make it hackable,” Martijn Grooten, principal security researcher at Censys, wrote — a caution that sits beside Censys' own count that more than 87,000 internet-connected cameras across the EU, NATO members, and Ukraine are running services whose version matches a known‑exploited vulnerability.
What the Dutch AIVD and MIVD reported
On July 10 the Netherlands' civilian and military intelligence services, the AIVD and MIVD, published a cybersecurity advisory saying at least one Russian intelligence service is systematically hijacking internet‑connected security cameras across Europe and Ukraine. The services described the operation as ongoing, and said camera access in Ukraine had been "used in attempts to neutralise Ukrainian military personnel" and destroy their equipment. Within the Netherlands the services said they had caught a small number of cameras breached that were positioned directly on military logistics routes, and that the organisations operating those cameras were warned so they could lock them down.
How operators are gaining and using access
The advisory and Censys' analysis describe a low‑tech initial footprint: operators scan the internet for exposed devices, fingerprint IP cameras by brand, and enter the ones still using default passwords, obsolete firmware, or factory settings. From a compromised feed, image‑recognition software runs automated searches through video for military vehicles and the cargo they carry. The advisory states that "none of the access the advisory describes needs a zero‑day" — the value of the intelligence flow depends largely on what the camera happens to be pointing at.
Censys' scan, CVE counts, and important caveats
Censys counted more than 87,000 hosts across the EU, NATO members, and Ukraine running a service whose version matches a known‑exploited vulnerability, a total the company calls a lower bound. More than 4,000 of those hosts sit in Ukraine. In the Netherlands specifically, Censys found 45,386 cameras reachable from the public internet and flagged 1,992 as running a service with a known‑exploited version; narrowing that to bugs in camera software itself reduced the figure to 541.
Censys emphasises that a service banner or version match is not the same as a reachable exploit. The company highlighted two specific vulnerabilities it counts as exploited in the wild: CVE‑2016‑7407, which sits in dropbearconvert (a local key‑import tool in the Dropbear SSH server) and was fixed in July 2016; and CVE‑2021‑39275, an out‑of‑bounds write that Apache patched in 2.4.49 in 2021. Censys flagged 159 Dutch hosts matching CVE‑2016‑7407 and 112 matching CVE‑2021‑39275. Neither CVE appears in CISA's Known Exploited Vulnerabilities catalog, the article notes.
The Hacker News has asked Censys whether its counts are version matches alone or confirm a vulnerable configuration, and what evidence classifies the two CVEs as exploited in the wild; the story says it will be updated with any response.
Concrete mitigations the services recommend
- Find what is exposed: identify cameras reachable from the public internet via forgotten port‑forwards, UPnP mappings, or vendor cloud relays, and prioritise those overlooking transport routes, ports, and sensitive sites.
- Keep video streams off the public internet: turn off port forwarding and UPnP, and reach cameras through a VPN.
- Replace default credentials and enable MFA where supported; if a device lacks MFA, keep it off the public internet entirely.
- Aim the lens deliberately: keep logistics routes, loading docks, and other sensitive areas out of frame, and mask what cannot be avoided.
- Patch firmware and software, and when purchasing choose cameras that ship with years of security support rather than months.
What this means for technologists, procurement leaders, and military logistics
Technologists and security teams should prioritise discovery and isolation: the advisory frames the problem as one of exposure and access, not exotic exploits. Procurement leaders are pushed to demand longer security support windows and to avoid devices that arrive with default credentials and short update lifecycles. For military logistics planners the advisory makes a practical point explicit — a compromised roadside or business camera can be turned into a targeting aid — and the Dutch services' confirmed breaches on logistics routes show the risk is not hypothetical.
The record published July 10 ties a broadly exposed technical surface — tens of thousands of IP‑reachable cameras whose software versions match known vulnerabilities — to confirmed, if limited, intrusions and to active misuse in Ukraine. The next, obvious fact to establish is scale: how many of those version matches represent reachable exploits, and how many feeds have been actively ingested by image‑recognition pipelines. The Hacker News has asked Censys for clarifications on that point and said it will update the story with any response.
