A compromised chicken-coop camera watched Israeli border forces
Civilian video cameras have become wartime reconnaissance assets, according to a Wall Street Journal investigation documenting how intelligence agencies and hacker groups turn webcams, doorbells, traffic controls and baby monitors into tools for spying, targeting and psychological operations across the Russia-Ukraine war and the war with Iran. The Journal said it spoke with intelligence agencies, cybersecurity experts, military officials and hackers, and reviewed dozens of hours of footage and hundreds of images, much of it made public by hackers, independently verifying their authenticity by geolocating locations and checking for signs of digital manipulation.
As U.S. and Israeli forces bombed Iran early this year, a poultry farmer in northern Israel decided to check on his chickens. When he launched the app on his phone for the webcam outside his coop, he was alarmed to see that its language had been switched to Arabic. He contacted Israel’s National Cyber Directorate, which found that hackers had taken control of the Chinese-made camera. The hackers weren’t interested in chickens: the camera’s orientation on the coop offered a line of sight to the movements of Israeli security forces along the nearby border with Lebanon. The directorate said it helped the farmer harden the camera’s security and adjust its viewing angle to stop capturing military operations.
The farmer’s webcam was one of an estimated 1.2 billion internet-connected cameras worldwide, according to cybersecurity consultants S-RM. The devices have become a background fixture of daily life in the form of security systems, doorbells, traffic controls and even baby monitors, and potentially any of them are vulnerable to snooping, cybersecurity experts and hackers say. “We are now seeing the conversion of civilian surveillance into wartime intelligence collection,” said Alexander Leslie, a national-security expert at threat-intelligence consultants Recorded Future, who sees a global “soft underbelly” in omnipresent digital eyeballs.
Intelligence agencies scour the internet for vulnerable cameras and robotically tap in to them by testing millions of passwords. AI has made it even easier to hack into them and analyze their data at scale, transforming cameras that were designed to boost safety into tools for combatants to track, surveil and attack the enemy, often surpassing the abilities of human intelligence analysts, the Journal reported. Algorithms digest endless reams of footage to find hidden gems and patterns for agents to monitor. “AI changed everything,” said Kristopher Kortright, leader of Team OneFist, an international hacker group supporting Ukraine in its war with Russia.
Russia and Ukraine have ramped up camera-hacking in their war, aiming to spy on each other, find new targets and assess damage from their attacks. Team OneFist helped Ukrainian forces find and attack a secret Russian air base in late 2022. The group took control of a camera in Sevastopol, the largest city in Ukraine’s Crimean peninsula, which Russia has occupied since 2014. The camera sat on a tall building on the city’s west side near the coast, and its vantage point gave the hackers a wide view of the surrounding area and the Black Sea. By rotating and zooming the camera to monitor Russian helicopters, submarines and ships, the hackers tracked a Russian military helicopter to a location near a local airport, where they discovered a previously unknown Russian air base. Team OneFist shared the information with Ukrainian forces, who soon after launched attacks against the base, damaging Russian planes and air-defense systems.
Early in the Ukraine war, Team OneFist watched feeds from cameras on Russia’s Kerch Strait Bridge to Crimea, providing images that helped refine attack plans, including the fact that Russia had installed motion detectors underneath the bridge to thwart waterborne attacks. Ukraine detonated a truck full of explosives on the bridge in October 2022. Hacked cameras are taking over roles in targeting, damage assessments and other combat intelligence-gathering that were previously supplied by aerial reconnaissance or on-the-ground spies, the Journal reported. Penetrating a well-placed camera can get analysts closer to targets and carries less risk than infiltrating even the canniest secret agent, and video cameras operate silently, often in restricted areas. Ukraine’s penetration of Russian camera feeds from unreachable locations has helped Kyiv strike Moscow’s troops and infrastructure. Information from hacked cameras “can shorten decision cycles in exactly the way modern militaries care about,” said Recorded Future’s Leslie.
In 2024, Russian hackers commandeered residential webcams in Kyiv, including one installed by a condominium association to monitor the neighborhood. Ukraine’s security service, the SBU, said Russia intended to use the hacked video feeds to find targets in the capital and “to adjust missile attacks on Ukraine,” refining their aim for subsequent strikes. Russia “is constantly trying to obtain intelligence to prepare further strikes on Ukrainian cities, including through unauthorized access to video surveillance systems,” the SBU said. The SBU said it has identified and secured, reoriented or blocked roughly 40,000 video cameras that posed potential security risks since Russia’s 2022 invasion.
Russian efforts extend beyond the war zone. Dutch intelligence agencies warned in July that “Russian state actors are systematically conducting digital espionage operations” by hacking into cameras across Europe, the agencies said. The operations aim to collect data on military transport routes, arms deliveries to Ukraine and the whereabouts of Ukrainian military personnel. Cybersecurity consultants CloudSEK recently discovered an exposed server they suspect belongs to a Russian-speaking hacker, containing hundreds of webcam images of Ukrainian facilities involved in defense, government, energy and communications, plus assorted views of daily life. CloudSEK said many of the images came from locations near Ukraine’s borders with NATO ally Romania; the Journal could not independently verify the locations of some interior scenes in the material.
Webcams are also playing an increasingly important role in the war with Iran. Israel hacked into Iranian traffic cameras to gather intelligence used in the assassination of Iranian Supreme Leader Ali Khamenei earlier this year, the Journal reported. An Iran-linked group called Moses Staff hacked into a Jerusalem security camera to monitor the 2022 bus stop bombings by a Palestinian militant that killed two people and injured more than 20 others, Israel’s cyber directorate said. This year, Iranian-linked groups have hacked into more than 250 sensitive Israeli security cameras in incidents that pose immediate danger to national security, according to the directorate, more than in previous years. The compromised cameras include license-plate readers and security cameras near strategic sites and places where soldiers gather, including military outposts in northern Israel, near the border with Lebanon.
The total number of cameras breached in Israel since the start of the Iran war is far higher, the cyber directorate said, adding that out of hundreds of thousands of cameras connected to the internet there, tens of thousands have vulnerabilities that Iranian hackers could take advantage of like default passwords. Iran and its proxies have broken into hundreds of Israeli webcams and security cameras that Israeli officials consider sensitive to national security, like the one on the chicken coop. “They can’t look through binoculars” to see Israel from Iran, said Eliav Noori, a cybersecurity expert at Israel’s cyber directorate. “So they take advantage of cameras that are exposed to the internet and turn them into lookout points.”
While private individuals and enterprise-network managers are increasingly attuned to cybersecurity, web-connected devices like cameras may have fewer built-in protections and not be consistently monitored, patched or updated, said Xu Zou, senior vice president for cloud security services at cybersecurity company Palo Alto Networks. Information-security specialists inside companies and governments often aren’t aware of connected cameras, which are frequently installed and operated by facilities managers or other non-IT teams, he said. “Those teams have very little cybersecurity awareness and knowledge. Their job is to mount that camera, power it on, and walk away,” said Zou. Palo Alto found last year that the vast majority of weakly secured internet-connected devices are webcams and digital video recorders, and that video-streaming and videoconferencing equipment, ubiquitous in office buildings around the globe, are particularly vulnerable.
That ubiquity has made the equipment useful for information warfare, not just military operations, said Ari Ben Am, an adjunct fellow at the Center on Cyber and Technology Innovation at the Foundation for Defense of Democracies, a Washington think tank. Anti-Israeli groups use imagery from hacked cameras in propaganda videos and content, he said. “For them it is about playing up their intelligence superiority.” The Iranian-linked group Handala taunts Israelis by boasting that it can see and hear them close to home. “Have a message? Find the nearest traffic camera and talk,” Handala wrote last year on one of its websites, which has since been taken down.
In Russia, officials from the Ministry of Industry and Trade were grousing on a videoconference call earlier this year about their reliance on Chinese drone components when an unexpected voice joined in. “Colleagues, can you hear me?” the voice asked. Yes, replied the meeting leader. The intruder then asked a seemingly technical question that quickly turned obscene. “Turn it off,” the meeting leader told his colleagues, in a video later posted online by Ukrainian hackers. Days later, Ukrainians posted fresh footage of how they hacked into a streaming army-recruitment pitch to students at a university in southern Russia, threatening death if they went to fight. The pro-Russian hacktivist group PalachPro posted a message on Telegram with images saying it had hacked more than 700 cameras in Ukraine and was tracking military recruitment efforts. Ukraine’s posts went viral, spotlighting the value of digital intrusions in the mind games that accompany conflicts.
Concerns about camera hacking are prompting fresh efforts to tighten security. Some Western countries have banned Chinese webcam brands that are easy to hack or are suspected of links to the government. But even protected cameras are vulnerable to determined hackers.
The risks reach ordinary households. Ondrej Svoboda in Prague was reading to his young children one evening in 2023 when the baby monitor in their room started emitting strange sounds of people talking and background music, as if from a bar. At first he thought his wife was using the two-way function but quickly realized that hackers had gotten into his system. “I didn’t think this was something that could happen to me,” recalled Svoboda, who worked at a cybersecurity company. “I was really scared—my heart was racing.” Trying to avoid frightening his children, he silently stared into the camera to show the hackers he knew about them and then unplugged the camera. For days he suffered nightmares as he struggled to understand how he got hacked. Eventually he remembered he had tried connecting his webcams to another app, which likely was insecure.
Vulnerable accessories linked into a network are among hackers’ prime targets, expanding what technicians call the attack surface. Often, cameras aren’t the target, but serve as the weak link in a larger hacking attempt. Ransomware group Akira tapped an unprotected webcam to get around one organization’s network-security systems and extort it, S-RM reported last year. Once hackers are inside a local network, they can usually probe stored files, email accounts and other devices, including cameras. “The Internet of Things is such a wild area that everything—whether you realize it or not—is an extension of your attack surface,” said Paul Caron, S-RM head of cyber for the Americas.