Inside a Russian-Speaking Operator's Toolkit for Compromising Ukrainian IP Cameras

Disclosure note: Hunt.io notified CERT-UA on July 30, 2026, and held publication for the standard 7-day disclosure window. The affected e-commerce operator was notified via CERT-UA.

In late May 2026, Hunt.io Attack Capture™ identified an open directory on 89.208.97[.]165 containing files pointing to the compromise of a Ukrainian e-commerce site. The intrusion itself, through credential theft and SQL injection, is only the starting point. Bash history and custom scripts recovered from the directory show the operator turned that access into a proxy server, and then used password spray attacks and attempted web shell deployment against Ukrainian government and military sites. During our investigation, we identified a custom platform built to find, exploit, and catalog internet-exposed IP cameras.

Every recovered file and the bash history used Russian as the primary language, indicating a likely native speaker. Python scripts scanning for vulnerable cameras were named for the areas they targeted, namely the frontline cities of Dobropillia, Kramatorsk, and Slavyansk. An open-source webcam scanner integrated into the tool surfaced a second, separately run directory at 213.165.63[.]49. That server ran a similar style of scanning and exploitation against TP-Link and MikroTik routers and cameras across 15 European countries, with a focus on Odessa, Burshtyn, and Kherson.

This research was prompted by a recent AIVD and MIVD advisory on Russian actors compromising IP cameras across the EU, NATO states, and Ukraine. Neither directory is linked to a state actor or any named group, but the recovered files offer a host-level view into how operations against camera devices are built and run.

The following summarizes the findings from our research.

Key Findings

• Hunt.io Attack Capture archived an open directory on 89.208.97[.]165:8888, exposing the compromise of a Ukrainian e-commerce site via SQL injection, which the operator then reused as a proxy and launch point for further activity.

• The same server's bash history records Tor-routed intrusion attempts against Ukrainian government and military sites, built with per-target credential lists, though the recovered files do not confirm whether any attempt succeeded.

• The same server hosted a Docker project named "camview" in its archive, used to scan, exploit, and maintain a list of internet-exposed cameras using known Dahua and Hikvision vulnerabilities.

• Recovered from the operator's own directory: a catalog of 58 compromised Ukrainian cameras, a saved still from one of them, and a log of live viewing sessions with session lengths, frame counts, and frame rates recorded per stream, access the operator used, not exposure inferred from a scan.

• A publicly available scanning tool integrated into camview led to a second, separately operated directory on 213.165.63[.]49, building anonymization proxy infrastructure that scanned routers across 15 European countries, with camera targeting focused on Ukraine.

• The second operator's toolkit relied on chaining multiple router and camera CVE's using custom Python scripts with additional focus/targeting of servers in Odessa, Burshtyn, and Kherson.

• Both operations show similar patterns: use of an open-source scanner to easily find and compromise cameras within specific geographic areas, and reliance on historically weak security on edge devices and internet exposed infrastructure.

The exposed directory captured multiple stages of the malicious activity within the operator's own files, beginning with the server that hosted them.

Inside the Directory

Aeza Group is a Russia-based bulletproof host sanctioned by OFAC in July 2025, with AS210644 named in that designation.

The server at 89.208.97[.]165 exposed 120 files across 31 subdirectories on port 8888, hosted by Aeza Group LLC (AS210644). Attack Capture flagged it as a malicious open directory on May 30, 2026. In addition to the operator's shell history, SQL injection and brute-force scripts, admin session data, and the camview archive were saved to the file manager.

Much of the tooling centered around a single victim, a Ukrainian e-commerce site. The scripts recovered from the directory show a progression from admin-panel discovery through full administrative access, developed across multiple versions of attack tooling.

SQL Injection Activity

One of the main scripts enumerated common administrative paths against the site using the AutoPwn suite, then directed error and UNION-based SQL injection at the OpenCart product search endpoint. The code simultaneously also checked for exposed .env and configuration files. OpenCart is a widely deployed open-source PHP shopping cart software. Access to its backend, which manages a store's orders, customer records, and configuration is an ideal foothold for the operator attacking the server.

A second script performed time-based blind injection, extracting the administrator password hash one character at a time through SLEEP()-delayed queries, submitting the recovered MD5 hash to an online lookup service. A third enumerated the database schema from information_schema.

Several Python files attempt to dump the contents of the database tables, though there was no indication of exfiltrated data on the directory.

Administrative Access

A stored admin URL, recovered credentials, and a live OpenCart session cookie confirm the operator reached the site's administrative backend. Two HTML files on the server repackage that access into a usable interface. Each sets the captured OCSESSID session cookie for the site's domain via inline JavaScript, then loads the OpenCart dashboard inside a frame, with navigation buttons to the store's orders, products, customers, categories, and settings sections. This provides the operator an easy way to quickly return to the compromised backend using the stolen session.

HTML files documenting login responses, dashboards and a tar.gz copy of the OpenCart panel were also observed on the directory.

Proxying Through the Victim Network

The operator coded a Python script to route their traffic through the compromised site. It authenticates to the victim's admin panel, then runs a local HTTP proxy that forwards inbound requests to the storefront and returns its responses. This places the operator's malicious activity behind the IP of the e-commerce server.

The script also included fallback logic in case the session expired, giving the operator persistent access. The shell history shows this relay was then used to scan for and attempt exploitation of additional targets.

Bash History Exposes Government, Military, and PII Targeting

A shell history is a chronological record of what the operator typed, in the order they typed it. The .bash_history recovered from 89.208.97[.]165, almost entirely in Russian, captured a sequence of intrusion attempts against Ukrainian government and military websites, each routed through Tor over a local SOCKS5 proxy on port 9050.

While the history preserves the commands and scripts executed, we cannot confirm success from the file alone, and no other references to the targeted organizations were observed on the server.

Ukrainian Government Council Sites

A significant portion of the government-focused activity targeted *-rada.gov.ua domains, the websites of local Ukrainian settlement and village councils, the majority running WordPress. The attempted attacks targeted the WordPress XML-RPC interface and REST API, with a desired end goal of planting a web shell or stealing valid administrator credentials. Instead of a generic password list, the operator created a custom text file using site-specific terms, Ukrainian city names, and year permutations, indicating the lists were tailored per target.

One council site, running a custom PHP administrative panel rather than WordPress, required a different approach. Sending the malicious probes over Tor, the operator cycled through a broad range of SQL injection techniques against the endpoint before turning to sqlmap. The small number of commands against the panel points to manual, hands-on iteration rather than an automated script.

A Ukrainian Military Domain

Brief reconnaissance probes were directed towards a Ukrainian military-branch domain, though this activity did not progress to exploitation in the recovered history. Because the site sat behind an anti-bot challenge, the operator used a headless Chrome browser over Tor, loading the site to fingerprint its CMS and check common administrative paths.

The table below summarizes the government and military targeting recorded in the history file:

Camera Scanning and Testing

The shell history transitions directly from the government and military targeting into camera reconnaissance, run from a directory titled "kiev_cams." The operator scanned lists of Ukrainian IPs for exposed camera services, checking common RTSP and HTTP camera ports and confirming live video with ffprobe. Some of this scanning was routed through a set of proxies the operator labeled as "Kyiv-based egress." Despite the name, at least one address in that set geolocates to Russia rather than Ukraine.

The scanning was organized by target area, with dedicated scripts and IP lists for specific eastern Ukrainian cities rather than a single national sweep:

• slavansk_cams.txt

• scan_kram_slav.sh

• dobor_scan.py

The directory also contained a mock Dahua camera server, a testing script used to emulate a vulnerable camera's login response. The code was not seen used against live targets, and appears to have been used to validate the operator's exploitation workflow against a controlled endpoint before running it against actual devices.

A file titled 'kramatorsk_snaps.html' appears to be a test run against SmartPSS (Smart Professional Surveillance System) run-devices. The IP addresses above each feed geo-locate to Russia and Kazakhstan, not Ukraine, which reads as a test run against whatever devices were reachable rather than live targeting from this file.

Ukrainian Vehicle Lookup Toolkit

Alongside the government agency and camera tooling, the bash history contained multiple OSINT scripts built on identifying Ukrainian personal data. Internally versioned as sysrfx v4.2.1, the code contains a header comment reading: ГЛАЗ БОГА УКРАИНА - ОСНОВНОЙ ДВИЖОК ("Eye of God Ukraine - main engine"). The tool itself is named after Glaz Boga ("Eye of God"), a notorious Russian "probiv" service, operated over Telegram that builds reports on individuals using open-source and leaked personal data.

The script works as a planning aid rather than a fully-functioning lookup service. When supplied with a license plate, vehicle identification number (VIN), or owner name, it combs through three hardcoded known Ukrainian vehicle-data breaches, and reports which would likely contain a matching record. The modules for performing live lookups using Telegram bots were commented out, suggesting the script may still be in development, or there was a problem with the service at the time.

From the reviewed files, there was no evidence of any extracted data records. The tool does show a capability being assembled to turn a Ukrainian vehicle plate into an identified owner.

The intrusion attempts and vehicle-lookup utility were assembled from individual scripts. The camview project was a purpose-built platform for finding, exploiting, and viewing exposed cameras.

The camview Project: Camera Access and Exploitation Tooling

Within the file camview.tar.gz was a Docker project containing a web application used to access compromised IP cameras and stream them in a browser. We refer to it as camview, the name used in the archive and in the project's own README. That name is also used by unrelated legitimate camera applications, which this project is not connected to.

Built with FastAPI and served by Uvicorn, it is packaged as a container running Python 3.11 with FFmpeg, Nmap, and masscan built into the image. FFmpeg transcodes the camera's RTSP feed to MJPEG for display, while Nmap and masscan provide an initial scanning layer. The app's README describes it primarily as a tool for viewing cameras, with the compromise functionality presented as a secondary "audit" feature.

The audit feature is where the exploitation happens. Target cameras are fingerprinted across more than a dozen brands, device information retrieved over open network video interface forum (ONVIF), and a series of vulnerabilities are tested. Credentials are then brute-forced over both HTTP and RTSP using a custom dictionary of 3,811 username:password pairs. Working credentials and stream URL patterns are written to disk and prioritized in later runs, so the tool learns against each vendor.

Multiple JSON files the operator kept in the camview data folder list 58 compromised cameras, all resolving to Ukrainian address space, each with the IP, vendor, and CVE or credential used to reach it. A separate log showed the operator opening live streams from these cameras, logging session lengths, frame counts, and frame rates. The majority of the cameras were labeled after the manufacturer, Hikvision or Dahua; a handful were labeled using the Russian word for a small café.

Running the application with empty data, we reconstructed the interface in a secure testing environment. A representation is shown below.

A saved still from one of the compromised cameras located in the evidence folder depicts what appears to be an industrial or warehouse space with Ukrainian writing visible. Though its authenticity cannot be verified, the file name is made up of an IP address separated by underscores, located in Ukraine.

Role Strings Point to a Second, Separate Application

camview authenticates through a single shared login and has no users or roles. A second, separate application governing access to the feeds was more structured.

A bash script designed to run on the server, vps_mon.sh parses incoming web traffic for four parameters: role, user_id, view_mode, and active_drone_type. The role values are then mapped to categories of drone operators: FPV, FPV air-defense, Mavic, fixed-wing, and one designated "Baba Yaga," and lastly an administrator role. user_id is used to identify individual accounts and checks the User-Agent for each request to distinguish Android and iOS clients.

From what we recovered, none of these parameters exist in camview. They belong to a separate Nginx-based application, one that was not found within the directory, but assigns per-user accounts, differentiates access by operator role, and is reachable from mobile devices.

The two applications point to a split in function. camview was used to compromise and catalog Ukrainian cameras. The second one, referenced only through vps_mon.sh and never recovered, assigns per-user accounts with role strings that line up with drone-operator categories and is reachable from mobile clients. Because we never recovered it, what it actually served those accounts is unconfirmed.

Note: The recovered data does not tie camview or the associated application to any military activity, past or ongoing, nor does it identify the operators behind the roles.

Ingram: The Open-Source Scanner Behind camview

camview does not use custom exploit scripts for the targeted cameras. It wraps Ingram, a publicly available webcam vulnerability scanner mounted into the container from the host. The project, written in Python, fingerprints cameras and tests them against a set of known CVE's and weak credential checks across Hikvision, Dahua, D-Link, and other vendors.

The CVEs Ingram targets described in the table below:

Ingram is the connective detail between this server and a second, unrelated open directory we discovered. Use of this open-source project and a similar targeting of cameras in Ukraine is where the similarities ended, and exposed a wider net attempting to exploit edge devices like routers.

A Second Scanning Operation, Same Shared Tool

Attack Capture discovered an open directory on 213.165.63[.]49 hosted on sistemaltd (AS215540) in Latvia, on July 21, 2026. The exposed server consisted of 1,704 files across 505 subdirectories, totaling 761 MB. The archived folders and files point to a particular focus around scanning for and exploiting routers and IP cameras. Again, Russian was the common language seen in a majority of the files on this directory.

Turning Edge Devices Into Proxies

The directory contained numerous scripts targeting cameras, MikroTik devices, TP-Link Archer routers and generic router brands. A pattern repeated itself across the codebases: compromise the device, enable a SOCKS5 proxy on it, and report the result back to a chisel reverse-tunnel listener on the server's port at 4444. The operator's objective is a pool of SOCKS5 proxies built from compromised edge devices.

Two known vulnerabilities were relied on to attempt exploitation of the TP-Link Archer routers:

• CVE-2024-53375 - Authenticated command injection (RCE)

• CVE-2024-57049 - Chained with 2024-53375 in a script titled archerpwn.py

The MikroTik script attempts to brute force the router API and issues the command to enable a proxy if successful. As Ingram is also used to target IP cameras, the same CVEs affecting Dahua and Hikvision were also observed on this directory.

Filenames like camworm.py and routerworm.py found on the server follow the same exploitation > proxy attempt described above, and contain no worm functionality.

Multiple European Countries Targeted

Several router scripts exposed a hardcoded API key for a well-known network asset discovery platform, which the operator used to locate exposed devices and write the results to a text file. The code queried the service for TP-Link and Asus routers across 15 European countries:

Ukraine, Poland, Romania, Moldova, Hungary, Czechia, Slovakia, Bulgaria, Germany, France, Netherlands, Italy, Spain, United Kingdom, and Austria.

All but Ukraine, Moldova, and Austria are NATO members. From what was saved in Attack Capture, we were unable to find any signs of successful exploitation among the camera and router targeting.

Other than the country codes mentioned in the code above, there were no additional mentions of those countries. What was present were IP address lists and Python scripts for cameras in Odessa, Burshtyn, and Kherson. Additionally, the file all_ingram.csv which would be loaded into Ingram for exploitation, consisted of only Ukrainian IP's. This suggests that while the operator scanned broadly across Europe, cameras were reserved for specific targets.

Two separately operated servers, tied together only by a shared open-source scanner, arrived at a similar objective: exposed cameras across Ukraine, exploited with known vulnerabilities for purposes unknown.

Mitigations

The following recommendations address the parts of these operations with the clearest defensive fixes: the camera and router compromise techniques, and the network behavior their proxy tooling produces.

• Replace default and weak credentials on cameras and routers with strong, unique passwords. Credential guessing was the primary access path before any exploit was attempted.

• Apply current firmware to Hikvision and Dahua cameras. The exploited flaws are years old and long patched.

• Patch TP-Link Archer and MikroTik devices and disable remote administration where it is not needed. Both require a reachable management interface.

• Keep cameras and routers off the public internet, behind a VPN or on isolated VLANs, rather than forwarding ports or relying on UPnP. Every device targeted here answered directly from the internet.

• Disable ONVIF and unauthenticated RTSP where they are not required. Both were tested for anonymous access before credentials or CVEs.

• Watch for scanning and brute-force activity at the network boundary, such as repeated connections to camera ports or sequential ONVIF and RTSP discovery requests. Camera-level logging is often shallow or absent, making network-level detection more reliable.

• Alert on edge devices opening outbound connections on ports such as 4444. A camera or router initiating an outbound tunnel is a strong compromise signal.

The techniques observed across both directories map to the following:

MITRE ATT&CK Mapping

Here are the full IOCs from this investigation.

Indicators of Compromise

Table 3: Network infrastructure

Summary

The two open directories discussed here show a low-cost, repeatable approach to compromising internet-exposed cameras and routers across Ukraine. Neither operator relied on new or novel techniques. Instead, default credentials, and years-old vulnerabilities were used to target and compromise edge devices. With the exception of the camview project, much of the tooling on both servers was cobbled together from public sources, not custom.

What ties the two together is a shared open-source tool, a reliance on exposed and unpatched devices, and a focus on Ukraine. The overlap is in tooling and approach rather than attribution, two operators arriving at the same method for a similar cause. An encouraging sign for defenders is that every technique observed here can be stopped in its tracks by basic security measures: strong credentials, current firmware, and removing internet access for devices that don't require it.

→ If you want to catch operator infrastructure at the open-directory stage instead of after the fact, book a demo with our team.