THE HAGUE (WorldSignal) — Russian state-backed hackers have systematically breached thousands of civilian internet-connected cameras in NATO countries, using the compromised devices to monitor military transport routes and logistics hubs supporting Ukraine, the Netherlands’ General Intelligence and Security Service (AIVD) and Military Intelligence and Security Service (MIVD) said in a report released July 10.
The operation, described by Dutch intelligence as a large-scale Russian espionage campaign, targeted IP cameras installed at private homes and commercial properties along critical transport corridors in several NATO member states. The AIVD and MIVD said the hackers exploited factory-default settings, outdated software and standard passwords to gain unauthorized access via public internet services that automatically search for vulnerable devices.
Dutch territory, a strategic transit hub for European military aid to Ukraine, was a primary focus of the operation, according to the intelligence agencies.
Real-time monitoring of NATO logistics
The breach allowed Russian intelligence to obtain real-time visual data on the movement of military equipment, identify types of weapons and track logistical flows toward Ukraine, the report stated. By accessing ground-level cameras, Russian forces gained a level of detail that satellite imagery or reconnaissance drones cannot match.
Dutch intelligence warned that the compromised cameras turned Europe’s civil infrastructure into a transparent zone for Russian surveillance, erasing the concept of a safe rear area for the alliance.
“Russia has built a system for continuous monitoring of key NATO transit routes, particularly the logistics arteries of the Netherlands,” the AIVD and MIVD said in a joint summary. “This allows Moscow to adjust its military plans in advance.”
Long-term threat to alliance security
The operation bore the hallmarks of a centralized state intelligence effort, marking a departure from previous cyber incidents, the Dutch services said. The accumulation of geospatial data on EU transport corridors creates a lasting security risk, potentially enabling not only espionage but also sabotage attacks on critical infrastructure in the event of escalation, they added.
“Moscow now has the ability to determine shift schedules, unit sizes, internal base logistics and air-defense positions,” the report stated. “This effectively destroys NATO’s system of secrecy.”
The Dutch agencies cautioned that even after partial detection, thousands of compromised devices may remain under Russian control as dormant access points. These could be reactivated suddenly during NATO military exercises or emergency deployments to the alliance’s eastern flank, undermining the ability to maneuver covertly on its own territory.
“Any attempt to secretly reinforce the Baltic states or Poland would be tracked by the Kremlin within minutes of equipment movement,” the intelligence services said. “The alliance loses the capacity for concealed maneuvering and rapid response.”
The breach also exposed the personal lives of NATO personnel, officers and officials, with private surveillance devices at their homes now falling within the Russian surveillance network. According to the Dutch report, this opens opportunities for identifying individuals working at sensitive sites, tracking daily routines and potentially enabling blackmail, kidnapping or targeted attacks on European soil.
Cyber hygiene failures
The operation highlighted widespread weaknesses in European cyber hygiene. Consumers’ use of default passwords and failure to update software allowed Russian hackers to automate the discovery of vulnerable devices through open internet services.
The AIVD and MIVD said the EU and NATO investments in “mobility corridors” for rapid troop transport have effectively become open platforms for Russian cyber monitoring. “Europe’s decades-long positioning of its technological standards as a symbol of progress is now exploited against it,” the report noted.
The full report is available on the AIVD website.
