[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fQBI5tZTCJxgZZVusTi11bNnOG4S0xM9yNB4j7zf7Eqo":3,"$fF7PFbCX0OLeWa0iDMg-T0CKswASs39ayAUR1BFQqDUc":50},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":16,"hero_image_url":17,"structured":18,"story_type":46,"created_at":47,"updated_at":48,"published_at":49},"russian-state-actors-exploit-exposed-ip-cameras-to-track-nato-troop-movements-in","Russian State Actors Exploit Exposed IP Cameras to Track NATO Troop Movements in Ukraine","AIVD and MIVD confirm systematic digital espionage via internet-facing IP cameras targeting EU, NATO, and Ukraine.","The Netherlands' AIVD and MIVD released a joint advisory warning that Russian state actors are systematically exploiting publicly exposed IP cameras to track NATO troop and supply movements in the ongoing Ukraine war.",[10,11,12,13,14,15],"Russia","IP Camera","NATO","Ukraine","AIVD","MIVD","# Russian State Actors Exploit Exposed IP Cameras to Track NATO Troop Movements in Ukraine\n\n*AIVD and MIVD confirm systematic digital espionage via internet-facing IP cameras targeting EU, NATO, and Ukraine.*\n\n**Tags:** `Russia` `IP Camera` `NATO` `Ukraine` `AIVD` `MIVD`\n\n> The Netherlands' AIVD and MIVD released a joint advisory warning that Russian state actors are systematically exploiting publicly exposed IP cameras to track NATO troop and supply movements in the ongoing Ukraine war.\n\n---\n\n## Vulnerability details\n\n| CVE | CVSS | EPSS | KEV | PoC | PRS risk |\n|---|---|---|---|---|---|\n| CVE-2026-85706 | 10.0 | 91.4% | ✅ listed | — | 89.65 (Critical) |\n\n## Russian state actors are systematically exploiting exposed IP cameras to track NATO troop and supply movements\n\nThe Netherlands General Intelligence and Security Service (AIVD) and the Netherlands Defence Intelligence and Security Service (MIVD) released a joint advisory warning EU, NATO, and Ukraine that Russian state actors are “systematically conducting digital espionage operations via IP cameras (cameras with internet access).”\n\nRunZero’s analysis confirms the advisory and adds context on why IP cameras are the entry point of choice for Russia in the Ukraine war. The technique is not new — cameras have been used to enable one country to target another in recent years, but this is the first confirmed use to track NATO troop and supply movements.\n\n## How the IP camera exploitation works\n\nThe cameras are not sitting on a local network. They are exposed directly to the internet, which is what makes them a viable target for a state actor. The underlying flaw is CVE-2026-85706, a CVSS 10.0 (v3.1) that CISA has added to its Known Exploited Vulnerabilities catalog. EPSS puts the probability of exploitation at 91.4%, placing it in the 100th percentile. No public PoC is known yet, but the KEV listing confirms active exploitation in the wild.\n\nA camera being internet-exposed does not automatically mean it is hackable or being actively accessed. RunZero notes that default logins are the preferred entry method because they are easy to gain and hard to detect. The CVE is the vulnerability that gets exploited, but the initial access often happens through the default credentials before the CVE is even triggered.\n\nThe cameras use or expose UPnP, a protocol that is frequently and easily abused. That makes the US and other Allied nations a target-rich environment. The most prolific IP camera manufacturers are already banned for use by any U.S. government entity because of their potential ties to the Chinese government, yet they are consistently purchased by non-government entities within the United States and other Allied nations. The number of U.S. commercial entities and private citizens running these cameras is high, and the UPnP exposure gives the Russian actors a reliable path in.\n\n## Who was hit and what they're tracking\n\nThe victims span four sectors: Government, medical technology, retail, and telecommunications. The cameras themselves are the most prolific IP camera manufacturers, already banned for use by any U.S. government entity because of their potential ties to the Chinese government. Non-government entities within the United States and other Allied nations consistently purchase these cameras, and the number of U.S. commercial entities and private citizens running them is undoubtedly high.\n\n## Why this matters for the Ukraine war\n\nRussia is not using the cameras for initial access alone. The advisory confirms the state actors are tracking NATO troop and supply movements through the IP camera feed, which is the first confirmed use of the technique in the Ukraine war. The cameras sit on the internet, not on a local network, which is what makes them viable for a state actor targeting NATO logistics.\n\nThe advisory is simple but effective. It gives defenders a clear way to detect and block the camera-based espionage without needing to reverse-engineer a full C2 channel. The technique is not new — cameras have been used to enable one country to target another in recent years — but this is the first confirmed use to track NATO troop and supply movements.\n\nThe abuse of IP-enabled cameras is not expected to stop anytime soon. The most prolific IP camera manufacturers are already banned for use by any U.S. government entity because of their potential ties to the Chinese government, yet they are consistently purchased by non-government entities within the United States and other Allied nations. The number of U.S. commercial entities and private citizens running these cameras is high, and the UPnP exposure gives the Russian actors a reliable path in.\n\n## Key points\n\n- AIVD and MIVD issued a joint advisory confirming Russian state actors are 'systematically conducting digital espionage operations via IP cameras' with internet access.\n- The operation targets EU, NATO member states, and Ukraine, using hacked IP cameras to track NATO troop and supply movements.\n- The most prolific IP camera manufacturers are banned for U.S. government use due to potential Chinese government ties but are widely purchased by non-government U.S. and Allied entities.\n- The IP cameras use or expose UPnP, a protocol that is frequently abused, making U.S. and Allied networks a target-rich environment.\n- RunZero analysis confirms the advisory and notes that exposed cameras with a CVE or KEV listing do not automatically mean active exploitation, but default logins remain the preferred entry method.\n\n## Further reading & sources\n\n- [The unforeseen risks of exposed IP cameras](https:\u002F\u002Fwww.runzero.com\u002Fblog\u002Fexposed-ip-cameras) — RunZero\n- [Multi-Stage \"BadPaw\" Malware Campaign Targets Ukraine - Infosecurity Magazine](https:\u002F\u002Fwww.infosecurity-magazine.com\u002Fnews\u002Fbadpaw-malware-targets-ukraine\u002F)\n- [The Escalating Cyber Risk Landscape in Regional Conflicts & Strategic Actions for 2026](https:\u002F\u002Fblog.eclecticiq.com\u002Fthe-escalating-cyber-risk-landscape-in-regional-conflicts-strategic-actions-for-2026)\n- [GitLab CVSS 10 exploited in wild](https:\u002F\u002Fdefend.network\u002Fbriefings\u002Fgitlab-artifactory-microsoft-claude-abuse-active-exploi-2026-09-12.html)","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Frussian-state-actors-exploit-exposed-ip-cameras-to-track-nato-troop-movements-in.png?v=74b95987f5",{"cves":19,"malware":30,"technologies":33},[20],{"id":21,"kev":22,"poc":23,"url":24,"cvss":25,"epss":26,"risk_band":27,"risk_score":28,"cvss_version":29},"CVE-2026-85706",true,false,"\u002Fvulnerabilities\u002FCVE-2026-85706",10,0.9296,"Critical",89.68,"3.1",[31],{"name":32},"BadPaw",[34,37,40,43],{"vendor":35,"product":36},"IP camera manufacturers","IP cameras",{"vendor":38,"product":39},"Microsoft","Windows",{"vendor":41,"product":42},"GitLab","GitLab Community Edition and Enterprise Edition",{"vendor":44,"product":45},"JFrog","Artifactory","threat_actor_activity","2026-09-30T07:07:04.966623+00:00","2026-10-16T12:28:01.92145+00:00",null,{"articles":51},[52,64,75,87],{"slug":53,"title":54,"summary":55,"tags":56,"hero_image_url":61,"story_type":62,"created_at":63},"apt28-deploys-badpaw-and-meowmeow-malware-duo-against-ukraine","APT28 Deploys BadPaw and MeowMeow Malware Duo Against Ukraine","APT28 (Fancy Bear) is running a new campaign against Ukrainian targets using two new .NET malware components, BadPaw (loader) and MeowMeow (backdoor), delivered through a phishing ZIP that opens an HTA file themed around Ukrainian border-crossing appeals.",[57,58,32,59,13,60],"APT28","Fancy Bear","MeowMeow","phishing","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fapt28-deploys-badpaw-and-meowmeow-malware-duo-against-ukraine.png?v=457c9d4fd3","campaign","2026-08-26T17:07:17.029451+00:00",{"slug":65,"title":66,"summary":67,"tags":68,"hero_image_url":73,"story_type":46,"created_at":74},"fancy-bear-ai-enabled-attacks-surge-89-in-crowdstrike-2026-report","Fancy Bear AI-Enabled Attacks Surge 89% in CrowdStrike 2026 Report","CrowdStrike's 2026 Global Threat Report shows Fancy Bear (APT28) AI-enabled adversary activity up 89% year-over-year, eCrime average breakout time at 29 minutes, and GenAI prompt injection confirmed at 90+ organizations.",[58,57,69,70,71,72],"CrowdStrike","LLM malware","GenAI prompt injection","eCrime","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Ffancy-bear-ai-enabled-attacks-surge-89-in-crowdstrike-2026-report.png?v=f7ed8c119c","2026-09-29T12:06:38.382267+00:00",{"slug":76,"title":77,"summary":78,"tags":79,"hero_image_url":85,"story_type":46,"created_at":86},"palo-alto-unit-42-405-ai-enabled-malware-samples-show-12-in-production","Palo Alto Unit 42: 405 AI-enabled malware samples show 12 in production","Palo Alto Networks Unit 42 analyzed 405 AI-enabled malware samples and found the space is dominated by PoC and researcher code, with only 12 samples hitting production endpoints across five distinct malware families.",[80,81,82,83,84],"AI malware","FunkSec","Palo Alto Unit 42","ransomware","LLM","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fpalo-alto-unit-42-405-ai-enabled-malware-samples-show-12-in-production.png?v=efb3f6f578","2026-09-26T12:10:59.266452+00:00",{"slug":88,"title":89,"summary":90,"tags":91,"hero_image_url":97,"story_type":46,"created_at":98},"gen-digital-researchers-unveil-wordlistloader-and-synkloader-malware-loaders-for","Gen Digital Researchers Unveil WordlistLoader and SynkLoader Malware Loaders for ClickFix Infostealer Delivery","Gen Digital researchers identified two new malware loaders, WordlistLoader and SynkLoader, that deliver infostealers and phishing credentials through the ClickFix technique and are sold to ransomware affiliates.",[92,93,94,95,96,83],"Gen Digital","ClickFix","WordlistLoader","SynkLoader","infostealer","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fgen-digital-researchers-unveil-wordlistloader-and-synkloader-malware-loaders-for.png?v=ea5de72eef","2026-09-25T12:05:45.613962+00:00"]