Video Cameras Are Hacked for War --- Combatants hijack vulnerable devices to track, surveil and attack the enemy

„As U.S. and Israeli forces bombed Iran early this year, a poultry farmer in northern Israel decided to check on his chickens. When he launched the app on his phone for the webcam outside his coop, he was alarmed to see that its language had been switched to Arabic. He contacted Israel's National Cyber Directorate, which found that hackers had taken control of the Chinese-made camera.

 

They weren't interested in chickens. The camera's orientation on the coop offered it a line of sight to the movements of Israeli security forces along the nearby border with Lebanon. The cyber directorate said it helped the farmer harden the camera's security and adjust its viewing angle to stop capturing military operations.

 

The farmer's webcam was one of an estimated 1.2 billion internet-connected cameras worldwide, according to cybersecurity consultants S-RM. The devices have become a background fixture of daily life in the form of security systems, doorbells, traffic controls and even baby monitors -- and potentially any of them are vulnerable to snooping, say cybersecurity experts and hackers.

 

"We are now seeing the conversion of civilian surveillance into wartime intelligence collection," said Alexander Leslie, a national-security expert at threat-intelligence consultants Recorded Future, who sees a global "soft underbelly" in omnipresent digital eyeballs.

 

The Wall Street Journal spoke with intelligence agencies, cybersecurity experts, military officials and hackers to scope out the extent and impact of the invasive surveillance. The Journal also reviewed dozens of hours of footage and hundreds of images, much of it made public by hackers, and independently verified their authenticity, by geolocating their locations and checking for any signs of digital manipulations.

 

Intelligence agencies scour the internet for vulnerable cameras and robotically tap in to them by testing millions of passwords. Now, AI has made it even easier to hack into them and analyze their data at scale, transforming cameras that were designed to boost safety into tools for combatants to track, surveil and attack the enemy -- often surpassing the abilities of human intelligence analysts. Algorithms digest endless reams of footage to find hidden gems and patterns for agents to monitor.

 

"AI changed everything," said Kristopher Kortright, leader of Team OneFist, an international hacker group supporting Ukraine in its conflict with Russia.

 

Russia and Ukraine have ramped up camera-hacking in their conflict, aiming to spy on each other, find new targets and assess damage from their attacks.

 

Israel, long a master of digital spycraft, hacked into Iranian traffic cameras to help forces collect intelligence used in the assassination of Iranian Supreme Leader Ali Khamenei earlier this year.

 

Iran and its proxies have struck back by breaking into hundreds of Israeli webcams and security cameras that Israeli officials consider sensitive to national security, like the one on the chicken coop.

 

"They can't look through binoculars" to see Israel from Iran, said Eliav Noori, a cybersecurity expert at Israel's cyber directorate. "So they take advantage of cameras that are exposed to the internet and turn them into lookout points."

 

In 2024, Russian hackers commandeered residential webcams in Kyiv, including one installed by a condominium association to monitor the neighborhood. Ukraine's security service, the SBU, said that Russia intended to use the hacked video feeds to find targets and "to adjust missile attacks on Ukraine," refining their aim for subsequent strikes. The SBU said it has identified and secured, reoriented or blocked roughly 40,000 video cameras that posed potential security risks since 2022.

 

Russia's efforts extend beyond the conflict zone. Dutch intelligence agencies warned in July that "Russian state actors are systematically conducting digital espionage operations" by hacking into cameras across Europe. The operations aim to collect data on military transport routes, arms deliveries to Ukraine and the whereabouts of Ukrainian military personnel, the agencies said.

 

Cybersecurity consultants CloudSEK recently discovered an exposed server they suspect belongs to a Russian-speaking hacker that contained hundreds of webcam images of Ukrainian facilities involved in defense, government, energy and communications, plus assorted views of daily life. CloudSEK said many of the images came from locations near Ukraine's borders with NATO ally Romania.

 

Webcams are also playing an increasingly important role in the war with Iran. An Iran-linked group called Moses Staff hacked into a Jerusalem security camera to monitor the 2022 bus stop bombings by a Palestinian militant that killed two people and injured more than 20 others, Israel's cyber directorate said.

 

This year, Iranian-linked groups have hacked into more than 250 sensitive Israeli security cameras in incidents that pose immediate danger to national security, according to Israel's cyber directorate, more than in previous years. Compromised cameras include license-plate readers and security cameras near strategic sites and places where soldiers gather, including military outposts near the border with Lebanon.

 

The total number of cameras breached in Israel since the start of the Iran war is far higher, the cyber directorate said, adding that out of hundreds of thousands of cameras connected to the internet there, tens of thousands have vulnerabilities that Iranian hackers could take advantage of like default passwords.

 

Hacked cameras are taking over roles in targeting, damage assessments and other combat intelligence-gathering that were previously supplied by aerial reconnaissance or on-the-ground spies. Penetrating a well-placed camera can get analysts closer to targets and carries less risk than infiltrating the canniest secret agent.

 

Video cameras operate silently, often in restricted areas.

 

Information from hacked cameras "can shorten decision cycles in exactly the way modern militaries care about," said Recorded Future's Leslie.

 

While private individuals and enterprise-network managers are increasingly attuned to cybersecurity, web-connected devices like cameras may have fewer built-in protections and not be consistently monitored, patched or updated, said Xu Zou, senior vice president for cloud security services at cybersecurity company Palo Alto Networks. Information-security specialists inside companies and governments often aren't aware of connected cameras, which are frequently installed and operated by facilities managers or other non-IT teams.

 

"Those teams have very little cybersecurity awareness and knowledge. Their job is to mount that camera, power it on, and walk away," said Zou.

 

Palo Alto found last year that the vast majority of weakly secured internet-connected devices are webcams and digital video recorders. The company also found that video-streaming and videoconferencing equipment -- ubiquitous in office buildings around the globe -- are particularly vulnerable. That has made them useful for information warfare, not just military operations, said Ari Ben Am, an adjunct fellow at the Center on Cyber and Technology Innovation at the Foundation for Defense of Democracies, a Washington think tank.

 

Anti-Israeli groups, he said, use imagery from hacked cameras in propaganda videos and content. "For them it is about playing up their intelligence superiority," he said.

 

Iranian-linked group Handala taunts Israelis by boasting that it can see and hear them close to home. "Have a message? Find the nearest traffic camera and talk," Handala wrote last year on one of its websites, which has since been taken down.

 

Vulnerable accessories linked into a network are among hackers' prime targets, expanding what technicians call the attack surface. Often, cameras aren't the target, but serve as the weak link in a larger hacking attempt. Ransomware group Akira tapped an unprotected webcam to get around one organization's network-security systems and extort it, S-RM reported last year. Once hackers are inside a local network, they can usually probe stored files, email accounts and other devices, including cameras.

 

"The Internet of Things is such a wild area that everything -- whether you realize it or not -- is an extension of your attack surface," said Paul Caron, S-RM head of cyber for the Americas.“ [1]

 

1. Video Cameras Are Hacked for War --- Combatants hijack vulnerable devices to track, surveil and attack the enemy. Michaels, Daniel; Peled, Anat; Czerny, Milan.  Wall Street Journal, Eastern edition; New York, N.Y.. 12 Oct 2026: A1.