Exploitation of Ukrainian IP Cameras Using Custom Tooling by Russian Operator

• •A Russian operator exploited 58 Ukrainian IP cameras using a custom tool named camview.
• •The attack method involved brute-forcing credentials and leveraging known CVEs.
• •The operation utilized a proxy script to relay traffic through compromised networks.

A Russian-speaking operator has been identified using a custom Docker project named camview to exploit and stream IP cameras in Ukraine. The tool, built with FastAPI, wraps the open-source Ingram scanner and employs a 3,811-entry dictionary to brute-force camera credentials over HTTP and RTSP. The operator's logs indicate live viewing sessions from 58 Ukrainian cameras, highlighting the scale of the operation. Notable CVEs targeted include CVE-2017-7921, CVE-2021-36260, CVE-2021-33044, CVE-2020-25078, and CVE-2024-53375. Additionally, the operator utilized a proxy script to relay traffic through compromised networks. The exploitation method leverages known vulnerabilities and public tools, indicating a sophisticated yet opportunistic approach. The current status of the operation remains active, with no state attribution confirmed.