Research details toolkits targeting Ukrainian IP cameras and routers

Aug 10, 2026 · Original article ↗

Summary

Hunt.io analyzed two exposed directories documenting credential theft, SQL injection, camera and router exploitation, and proxy tooling. One cataloged 58 compromised Ukrainian cameras; government and military attacks and exploitation by the second operation were unして

Key points

An exposed server contained evidence of a Ukrainian e-commerce site compromise through credential theft and SQL injection; a captured admin session confirmed access to its backend.
The operator used the compromised site as a proxy and recorded attempts against Ukrainian government and military websites, but the recovered files do not confirm those attempts succeeded.
A camera toolkit cataloged 58 compromised Ukrainian cameras and logs showed live viewing sessions. It used known Dahua and Hikvision vulnerabilities and weak-credential checks.
A second, separately operated server contained scripts targeting cameras and routers across 15 European countries, including tools to turn compromised devices into SOCKS5 proxies; successful exploitation was not confirmed.
The investigation found no evidence tying either operation to a state actor or named group, and no evidence of extracted e-commerce database records.
Hunt.io recommends strong unique passwords, current firmware, restricting internet exposure of cameras and routers, and monitoring for scanning and suspicious outbound tunnels.

Article Details

Attack Vectors: The first operator used credential theft and SQL injection against a Ukrainian OpenCart site, then used administrative access and a captured session cookie to reach its backend.
A Python HTTP proxy routed the first operator's traffic through the compromised e-commerce server. Recovered shell history shows the relay was used for further scanning and attempted exploitation.
Tor-routed attempts against Ukrainian council sites included credential guessing, SQL injection, and attempted WordPress web-shell deployment. The recovered files do not confirm success.
The first operator scanned exposed Ukrainian cameras, tested weak credentials and known vulnerabilities, and maintained a catalog of 58 compromised cameras.
The second operator's scripts attempted to compromise exposed cameras and routers, enable SOCKS5 proxies, and connect them to a chisel reverse-tunnel listener. Researchers found no signs of successful exploitation in the second directory.
Defensive Notes: Replace default or weak camera and router credentials with strong, unique passwords.
Apply current firmware to Hikvision and Dahua cameras and patch TP-Link Archer and MikroTik devices; disable remote administration where unnecessary.
Keep cameras and routers off the public internet, using a VPN or isolated VLANs instead of exposed ports or UPnP.
Disable ONVIF and unauthenticated RTSP when not required.
Monitor network-boundary traffic for repeated camera-port connections, sequential ONVIF or RTSP discovery, and credential-guessing attempts.
Alert on unexpected outbound tunnels from edge devices, including connections to port 4444.

Indicators of compromise

Type	Indicator	Context
IPV4	`213[.]165[.]63[.]49`	Separately operated server exposing router and camera scanning and exploitation files on port 8080.
IPV4	`89[.]208[.]97[.]165`	First operator's server, which exposed an open directory of intrusion scripts, shell history, and the camview archive on port 8888.