RF used hacked cameras for reconnaissance before strikes on Ukraine

The Russian Federation systematically exploits vulnerabilities in video surveillance systems for reconnaissance, target selection, and assessing the consequences of its military actions. Journalists from WSJ analysed dozens of hours of video footage and hundreds of images, as well as conducted interviews with intelligence agency representatives, military personnel, cybersecurity experts, and hackers.

Scale of the threat in Ukraine

Since the start of the full-scale invasion, the Security Service of Ukraine has identified approximately 40,000 cameras that posed a potential threat to national security. To prevent the enemy from using these video feeds, security agencies took measures: they protected devices from unauthorised access, changed the viewing angle, or completely blocked their operation.

In 2024, Russian cybercriminals gained access to cameras installed on residential buildings in Kyiv. Among them was a camera installed by a homeowners' association to monitor the area around the building. According to SBU data, Russia planned to use these video feeds to search for targets and adjust subsequent missile strikes on the capital.

Cyber operations beyond Ukraine

The activities of Russian hackers are not limited to Ukrainian territory. In July, Dutch intelligence agencies warned that Russian state structures are systematically hacking video surveillance cameras across Europe. According to their data, this is how they gather information on military transport routes, weapons supplies to Ukraine, and the locations of Ukrainian military personnel.

The role of artificial intelligence and the human factor

WSJ sources noted that artificial intelligence has significantly simplified both the process of hacking cameras and the processing of massive video datasets. Algorithms help analysts quickly find significant episodes and recurring patterns among thousands of hours of footage.

Experts explain the scale of the problem by elementary negligence in device configuration. Standard passwords, outdated software, and default settings make even household cameras an easy target for intelligence services that deliberately scan the network in search of vulnerable devices. Meanwhile, most cameras remain poorly protected: their software is rarely updated, and the staff responsible for configuration lack adequate training in cybersecurity.

Owners' lack of awareness of risks

The situation is complicated by the fact that camera owners — from residents of apartment buildings to operators of logistics infrastructure — largely do not realise that their equipment could become a tool of military reconnaissance. This makes preventive protection and timely firmware updates a critically important element of cybersecurity in wartime conditions.