Russian state hackers have been siphoning video from internet-connected civilian cameras, including home doorbell systems, to map NATO military transport routes and identify weapons flowing to Ukraine, Dutch intelligence services disclosed Friday in a joint public warning to allies.

The General Intelligence and Security Service, known as the AIVD, and the Military Intelligence and Security Service, or MIVD, described a "large-scale" campaign targeting European NATO members and Ukraine, with a small number of cameras confirmed to have been hacked along military logistical routes inside the Netherlands.

The two agencies said the intrusions gave Moscow a ground-level look at what was moving where, including the type of weapons and materiel being sent to Kyiv. Businesses that owned the affected cameras have been notified, the services said.

The tactic, according to the advisory the agencies published alongside the announcement, exploits the weakest link in modern surveillance: cheap IP cameras still running on default passwords, with outdated firmware and factory configurations.

Attackers scan the open internet for exposed devices, identify the make and model, then walk in. Dutch officials said the technique is now used systematically across other NATO and European Union countries.

The Telegraph, which reported the story earlier Friday, noted the agencies did not specify camera brands but said doorbell systems, widely marketed for remote phone monitoring, fit the profile.

Ukrainian and Israeli services have deployed the same playbook against Russia and Iran, respectively, in recent years, turning civilian optics into low-cost battlefield intelligence.

The Netherlands is a priority target because it functions as a transit hub for Western arms bound for Ukraine and because the Dutch government has been among Kyiv's more consistent military backers, the AIVD said.

The public advisory urged owners of IP cameras to change default credentials, disable Universal Plug and Play, avoid port forwarding, and update firmware, steps the agencies framed as essential for anyone operating cameras near transportation corridors used by defense shippers.

The disclosure comes days after NATO leaders met in Ankara, where Russia sharply criticized the alliance's pledges of continued military aid to Kyiv.

It also extends a pattern flagged in a May 2025 joint Western advisory that tied Russia's GRU-linked "Fancy Bear" unit to widespread targeting of IP cameras in Ukraine and bordering NATO states.

Dutch officials said they expect the campaign to continue and are pressing partners to harden exposed devices.