ctipilot.ch

Russian hijacking of IP cameras along NATO military-supply routes (2026-07)

campaign · campaign:russia-ip-camera-hijacking-nato-supply-routes-2026 single-source

AIVD/MIVD-disclosed (2026-07-11) compromise of internet-connected cameras reachable via default passwords or outdated firmware (including cameras operated by businesses along the routes) in the Netherlands, used by Russia-linked actors to monitor arms shipments to Ukraine. Triggered a coordinated NL/France/Germany/Finland ambassador summons and a NATO joint condemnation on 2026-07-13. No named Russian APT cluster was stated in the disclosure (NL Times/ANP, 2026-07-11 and 2026-07-13).

Coverage timeline
2
first 2026-07-13 → last 2026-07-19
Peak priority
high
1 high · 1 notable
Sources cited
6
5 hosts
Sections touched
2
active-threats, legacy-strategic
Co-occurring entities
1
see Related entities below
ATT&CK techniques
4
pinned v19.2 · see below
2026-07-132 appearances2026-07-19

Hunting pivots

ATT&CK techniques
T1078.001 ×2T1190 ×2T1133T1602.001
Affected products
Cisco IOSCisco IOS XE
Tags
espionage ×2nation-state ×2actively-exploitedlaw-enforcementrussia-nexus

ATT&CK techniques

4 techniques observed across 2 entries — derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.2 · compare on the matrix · Navigator layer (JSON)

Initial Access TA0001

T1078.001Valid Accounts: Default Accounts×2

Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems. Default accounts also include default factory/provider set accounts on other types of systems, software, or devices, including the root user account in AWS, the root user account in ESXi, and the default service account in Kubernetes.

Evidence: 2026-07-19/weekly-w29-russia-state-nexus-ci-prepositioning-sanctions · 2026-07-13/russia-ip-camera-hijacking-nato-military-supply-routes · ATT&CK page ↗

T1133External Remote Services×1

Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as Windows Remote Management and VNC can also be used externally.

Evidence: 2026-07-19/weekly-w29-russia-state-nexus-ci-prepositioning-sanctions · ATT&CK page ↗

T1190Exploit Public-Facing Application×2

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-07-19/weekly-w29-russia-state-nexus-ci-prepositioning-sanctions · 2026-07-13/russia-ip-camera-hijacking-nato-military-supply-routes · ATT&CK page ↗

Persistence TA0003

T1078.001Valid Accounts: Default Accounts×2

Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems. Default accounts also include default factory/provider set accounts on other types of systems, software, or devices, including the root user account in AWS, the root user account in ESXi, and the default service account in Kubernetes.

Evidence: 2026-07-19/weekly-w29-russia-state-nexus-ci-prepositioning-sanctions · 2026-07-13/russia-ip-camera-hijacking-nato-military-supply-routes · ATT&CK page ↗

T1133External Remote Services×1

Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as Windows Remote Management and VNC can also be used externally.

Evidence: 2026-07-19/weekly-w29-russia-state-nexus-ci-prepositioning-sanctions · ATT&CK page ↗

Privilege Escalation TA0004

T1078.001Valid Accounts: Default Accounts×2

Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems. Default accounts also include default factory/provider set accounts on other types of systems, software, or devices, including the root user account in AWS, the root user account in ESXi, and the default service account in Kubernetes.

Evidence: 2026-07-19/weekly-w29-russia-state-nexus-ci-prepositioning-sanctions · 2026-07-13/russia-ip-camera-hijacking-nato-military-supply-routes · ATT&CK page ↗

Stealth TA0005

T1078.001Valid Accounts: Default Accounts×2

Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems. Default accounts also include default factory/provider set accounts on other types of systems, software, or devices, including the root user account in AWS, the root user account in ESXi, and the default service account in Kubernetes.

Evidence: 2026-07-19/weekly-w29-russia-state-nexus-ci-prepositioning-sanctions · 2026-07-13/russia-ip-camera-hijacking-nato-military-supply-routes · ATT&CK page ↗

Collection TA0009

T1602.001Data from Configuration Repository: SNMP (MIB Dump)×1

Adversaries may target the Management Information Base (MIB) to collect and/or mine valuable information in a network managed using Simple Network Management Protocol (SNMP).

Evidence: 2026-07-19/weekly-w29-russia-state-nexus-ci-prepositioning-sanctions · ATT&CK page ↗

Story timeline

  1. 2026-07-19Russian state-nexus pre-positioning against European critical infrastructure reached a new attribution-and-consequence threshold this week — router hijacking, the Turla espionage cluster, the Poland grid attack and camera surveillance all named on the same day the EU and UK imposed their first joint cyber-sanctions
    legacy-strategicRussian FSB pre-positioning against European CI went public — router hijacking, the Turla and Poland-grid attributions, and the first joint EU/UK sanctions
  2. 2026-07-13AIVD/MIVD: Russia-linked actors hijack default-credential IP cameras along NATO military-supply routes to monitor Ukraine-bound shipments
    active-threatsDutch intelligence: Russia hijacked default-credential internet cameras along military-supply routes; four EU states summon Russian ambassadors

Where this entity is cited

  • active-threats1
  • legacy-strategic1

Source distribution

  • nltimes.nl2 (33%)
  • cert.ssi.gouv.fr1 (17%)
  • gov.uk1 (17%)
  • media.defense.gov1 (17%)
  • ncsc.gov.uk1 (17%)

Co-occurring entities

Derived — referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

All cited sources (6)

Entries about Russian hijacking of IP cameras along NATO military-supply routes (2026-07) (2)

2026-07-19 · view entry permalink →

HIGHexploitedNATOA1

Russian state-nexus pre-positioning against European critical infrastructure reached a new attribution-and-consequence threshold this week — router hijacking, the Turla espionage cluster, the Poland grid attack and camera surveillance all named on the same day the EU and UK imposed their first joint cyber-sanctions

If you did nothing this week: the internet-facing routers and IP cameras in your estate are exactly the collection surface a 19-agency advisory and Dutch intelligence just documented Russian state actors harvesting at scale — default or weak SNMP community strings, unpatched Cisco Smart Install, and default-credential cameras are being enumerated and read now, not hypothetically.

The week's Russian-state thread was not one disclosure but four landing together, which is itself the signal. The router-hijacking advisory describes FSB Centre 16 (Static Tundra / Berserk Bear) doing something deliberately unglamorous at scale: "The actors scan for Internet IP ranges with active Simple Network Management Protocol (SNMP) agents that accept common or default community strings for authentication" and pair that with the seven-year-old Cisco Smart Install flaw CVE-2018-0171 (CISA KEV) to pull device configurations out of energy, government, telecom, finance and healthcare networks (joint advisory, 2026-07-13). The consequence side arrived the same day: "The UK together with EU member states has also today formally attributed the December 2025 attack on Poland's energy grid to Russia's FSB Centre 16" (NCSC-UK, 2026-07-13), with the FCDO framing that a "reckless attack ... could have caused 500,000 citizens to lose electricity in the depths of winter" and the EU and UK issuing their first joint cyber-sanctions package (UK Government, 2026-07-13). France's ANSSI simultaneously attributed the Turla espionage set (SecretBlizzard) to the same FSB 16th Centre in CERTFR-2026-CTI-005, with the EU sanctioning 9 individuals and 4 organisations and the UK 24 (CERT-FR, 2026-07-13).

Running underneath all of it, Dutch intelligence disclosed that "Russian actors had compromised 'a small number of cameras' on routes for military shipments to Ukraine" — internet-connected cameras reachable because of default passwords and outdated firmware — a physical-surveillance use of the same exposed-device class the router advisory addresses (NL Times, 2026-07-11).

The actors scan for Internet IP ranges with active Simple Network Management Protocol (SNMP) agents that accept common or default community strings for authentication

NSA / CISA / FBI / DC3 joint Cybersecurity Advisory (19 agencies, 13 countries) 2026-07-13

The UK together with EU member states has also today formally attributed the December 2025 attack on Poland's energy grid to Russia's FSB Centre 16.

NCSC-UK 2026-07-13

Dutch intelligence services disclosed Friday that Russian actors had compromised “a small number of cameras” on routes for military shipments to Ukraine.

NL Times (ANP) 2026-07-11

Builds on: 2026-07-13/fsb-centre-16-static-tundra-router-hijacking-advisory · 2026-07-13/russia-ip-camera-hijacking-nato-military-supply-routes

synthesis19 Jul 23:42Zmulti-sourceOpen finding ↗
Sources: NSA / CISA / FBI / DC3 joint Cybersecurity Advisory (19 agencies, 13 countries) · NCSC-UK · CERT-FR (ANSSI) · UK Government (FCDO) · NL Times (ANP)

2026-07-13 · view entry permalink →

NOTABLENATOB2

AIVD/MIVD: Russia-linked actors hijack default-credential IP cameras along NATO military-supply routes to monitor Ukraine-bound shipments

Dutch intelligence services AIVD (General Intelligence and Security Service) and MIVD (Military Intelligence and Security Service) disclosed on 2026-07-11 that Russia-linked actors compromised "a small number" of internet-connected cameras positioned along routes used to move military supplies to Ukraine through the Netherlands — including cameras operated by businesses located on those routes — giving the operators remote viewing access to the shipments and equipment being moved (NL Times/ANP, 2026-07-11). The agencies state the cameras were reachable chiefly because they "still us[e] default passwords or outdated firmware" — weak/default-credential abuse and unpatched embedded firmware on internet-exposed devices, not a bespoke exploit chain. On 2026-07-13, after EU ministerial consultations in Brussels, the Netherlands summoned the Russian ambassador; France, Germany and Finland took the same step over related espionage and sabotage concerns, and NATO issued a joint statement condemning "the persistent malicious cyber activities of Russia" (NL Times/ANP, 2026-07-13). AIVD/MIVD separately warned businesses located along military-logistics routes to harden their camera and IoT security. This is a distinct technical story from the same-day FSB Centre 16 router-hijacking advisory and the Turla espionage attribution covered separately today — here the compromised asset class is consumer/commercial IP cameras used for physical-logistics surveillance.

Dutch intelligence services disclosed Friday that Russian actors had compromised “a small number of cameras” on routes for military shipments to Ukraine. The breaches allowed the hackers remote viewing access, according to statements from the General Intelligence and Security Service (AIVD) and the Military Intelligence and Security Service (MIVD).

We strongly condemn the persistent malicious cyber activities of Russia. The country uses its cyber ecosystem to attack allies and NATO partners.

NL Times (ANP) 2026-07-11
incident13 Jul 20:36Zsingle-sourceOpen finding ↗
Sources: NL Times (ANP)