Vulnerability details
| CVE | CVSS | EPSS | KEV | PoC | PRS risk |
|---|---|---|---|---|---|
| CVE-2026-85706 | 10.0 | 91.4% | ✅ listed | — | 89.65 (Critical) |
Russian state actors are systematically exploiting exposed IP cameras to track NATO troop and supply movements
The Netherlands General Intelligence and Security Service (AIVD) and the Netherlands Defence Intelligence and Security Service (MIVD) released a joint advisory warning EU, NATO, and Ukraine that Russian state actors are “systematically conducting digital espionage operations via IP cameras (cameras with internet access).”
RunZero’s analysis confirms the advisory and adds context on why IP cameras are the entry point of choice for Russia in the Ukraine war. The technique is not new — cameras have been used to enable one country to target another in recent years, but this is the first confirmed use to track NATO troop and supply movements.
How the IP camera exploitation works
The cameras are not sitting on a local network. They are exposed directly to the internet, which is what makes them a viable target for a state actor. The underlying flaw is CVE-2026-85706, a CVSS 10.0 (v3.1) that CISA has added to its Known Exploited Vulnerabilities catalog. EPSS puts the probability of exploitation at 91.4%, placing it in the 100th percentile. No public PoC is known yet, but the KEV listing confirms active exploitation in the wild.
A camera being internet-exposed does not automatically mean it is hackable or being actively accessed. RunZero notes that default logins are the preferred entry method because they are easy to gain and hard to detect. The CVE is the vulnerability that gets exploited, but the initial access often happens through the default credentials before the CVE is even triggered.
The cameras use or expose UPnP, a protocol that is frequently and easily abused. That makes the US and other Allied nations a target-rich environment. The most prolific IP camera manufacturers are already banned for use by any U.S. government entity because of their potential ties to the Chinese government, yet they are consistently purchased by non-government entities within the United States and other Allied nations. The number of U.S. commercial entities and private citizens running these cameras is high, and the UPnP exposure gives the Russian actors a reliable path in.
Who was hit and what they're tracking
The victims span four sectors: Government, medical technology, retail, and telecommunications. The cameras themselves are the most prolific IP camera manufacturers, already banned for use by any U.S. government entity because of their potential ties to the Chinese government. Non-government entities within the United States and other Allied nations consistently purchase these cameras, and the number of U.S. commercial entities and private citizens running them is undoubtedly high.
Why this matters for the Ukraine war
Russia is not using the cameras for initial access alone. The advisory confirms the state actors are tracking NATO troop and supply movements through the IP camera feed, which is the first confirmed use of the technique in the Ukraine war. The cameras sit on the internet, not on a local network, which is what makes them viable for a state actor targeting NATO logistics.
The advisory is simple but effective. It gives defenders a clear way to detect and block the camera-based espionage without needing to reverse-engineer a full C2 channel. The technique is not new — cameras have been used to enable one country to target another in recent years — but this is the first confirmed use to track NATO troop and supply movements.
The abuse of IP-enabled cameras is not expected to stop anytime soon. The most prolific IP camera manufacturers are already banned for use by any U.S. government entity because of their potential ties to the Chinese government, yet they are consistently purchased by non-government entities within the United States and other Allied nations. The number of U.S. commercial entities and private citizens running these cameras is high, and the UPnP exposure gives the Russian actors a reliable path in.
Key points
- AIVD and MIVD issued a joint advisory confirming Russian state actors are 'systematically conducting digital espionage operations via IP cameras' with internet access.
- The operation targets EU, NATO member states, and Ukraine, using hacked IP cameras to track NATO troop and supply movements.
- The most prolific IP camera manufacturers are banned for U.S. government use due to potential Chinese government ties but are widely purchased by non-government U.S. and Allied entities.
- The IP cameras use or expose UPnP, a protocol that is frequently abused, making U.S. and Allied networks a target-rich environment.
- RunZero analysis confirms the advisory and notes that exposed cameras with a CVE or KEV listing do not automatically mean active exploitation, but default logins remain the preferred entry method.