SecurityNot yet confirmed elsewhere1 publisher2 min readPublished
Iranian-linked hackers used a chicken coop camera to watch Israeli forces on the Lebanon border
Israel's National Cyber Directorate traced a hijacked chicken coop camera to Iranian-linked hackers, the Wall Street Journal reported. Pro-Ukraine and Russian operators run the same collection, but this account ties factory passwords only to the Israeli case.
The Watch · Security desk
More than 250 sensitive cameras in Israel compromised by Iranian-linked groups, Israeli officials said; roughly 40,000 cameras Ukraine's Security Service identified, secured or blocked as risks; roughly 1.2 billion cameras online worldwide, an S-RM estimate.
| Figure | Value | Note | Claim |
|---|---|---|---|
| Sensitive Israeli cameras compromised, officials say | 250 cameras, over | 6 | |
| Cameras Ukraine identified, secured or blocked | 40,000 cameras, roughly | after the full-scale invasion began | 5 |
| Internet-connected cameras worldwide | 1,200,000,000 cameras, roughly | S-RM estimate | 3 |
What happened
- According to Israeli officials, Iranian-linked groups compromised more than 250 sensitive cameras in Israel, among them license-plate readers and cameras close to military outposts and gathering points.
- Ukraine-supporting hackers from Team OneFist rotated a hijacked Sevastopol camera across the Black Sea and tracked a Russian military helicopter to what they called a previously unknown air base.
- A July 2026 advisory from the Dutch services AIVD and MIVD said Russian state actors compromised cameras across Europe and Ukraine to track weapons-delivery routes and Ukrainian personnel.
- Once Russia's full-scale invasion began, Ukraine's Security Service said, it found, secured or blocked about 40,000 cameras it considered security risks.
Why it matters
- exposure S-RM estimates roughly 1.2 billion cameras are online worldwide, so any farm, shop or home camera with a view of a border, road or base is a candidate sensor for whoever scans first.
- constraint Facilities and operations teams often install cameras outside formal security processes, so a security team may never see them to change the password.
- capability Attackers use automated image recognition to search camera footage for military vehicles, cargo and personnel, so a hijacked feed does not need an analyst watching it.
The default-password link rests on one passage. Gadget Review, summarizing Wall Street Journal reporting, says the attackers simply logged in with credentials the camera shipped with and nobody had changed [12]. The farmer noticed when the interface switched to Arabic [1]. Israel's National Cyber Directorate then made the Iranian-linked attribution, per the Journal [2].
Nothing else in the account names an entry method. It does not say how Team OneFist got into the Sevastopol camera, how the Russian actors in the Dutch advisory got into theirs, or how the 250 Israeli cameras were taken. It also does not date the Israeli or Sevastopol incidents. Only the Dutch advisory carries a date, July 2026.
Some of what is reported is the actors' own account. The description of the Sevastopol air base as previously unknown comes from Team OneFist. Ukrainian forces later struck the site, damaging aircraft and air-defense systems, according to the Journal reporting Gadget Review relays [14]. Team OneFist is also reported to have watched cameras around the Kerch Strait Bridge as an aid to refining attack plans [15].
The method scales. Gadget Review says automated scanning finds vulnerable cameras at scale [10], and Palo Alto Networks research found that a large share of weakly secured internet-connected devices are webcams and digital video recorders [7]. Alexander Leslie of Recorded Future described the trend, per the Journal, as the conversion of civilian surveillance into wartime intelligence collection [11].
Three sides now appear in the account doing this: Iranian-linked groups against Israel, a pro-Ukraine group against Russia, and Russian state actors against Europe and Ukraine. In our view that is a sustained collection practice with several operators, and the Israeli case, if the source is right about the password, shows how low the entry bar can be.
The remedies the source lists sit with sellers. Makers can require unique credentials at first setup instead of relying on users to change defaults, publish end-of-support dates, disable remote access by default and build firmware prompts users cannot permanently dismiss [16]. Retailers can set minimum security baselines as a condition of stocking a product, and cloud-video providers can flag anomalous logins [17].
What to watch
- Whether the Journal's underlying reporting or Israel's cyber directorate states how the 250 cameras were entered, default passwords or software flaws.
- Any further AIVD and MIVD guidance that names camera makers, models or entry methods.
- Any camera maker or retailer commitment to unique credentials at first setup.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence40
- Adoption
- Insufficient
- Hype gap+25
- Incentives20
- Confidence50
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
A poultry farmer in northern Israel noticed that the interface on his Chinese-made chicken coop camera had switched to Arabic.
- [2]
Israel's National Cyber Directorate traced the hijacked chicken coop camera to Iranian-linked actors, who used its field of view to observe Israeli security forces near the Lebanon border, according to Wall Street Journal reporting.
- [3]
S-RM, a cybersecurity consultancy, estimates roughly 1.2 billion cameras are connected to the internet worldwide.
- [4]
The Dutch intelligence services AIVD and MIVD warned in a July 2026 advisory that Russian state actors systematically compromised cameras across Europe, the Netherlands, other EU and NATO states, and Ukraine to gather intelligence on weapons-delivery routes and the movements of Ukrainian military personnel.
- [5]
Ukraine's Security Service said it identified, secured, or blocked roughly 40,000 cameras deemed security risks after Russia's full-scale invasion began.
- [6]
Israeli officials said Iranian-linked groups compromised more than 250 sensitive cameras inside Israel, including license-plate readers and cameras positioned near military outposts and gathering points, according to Wall Street Journal reporting.
ReportedSupportedSource: Israeli officials, via Wall Street Journal and Gadget ReviewView cited source - [7]
Palo Alto Networks research found that webcams and digital video recorders make up a large share of weakly secured internet-connected devices.
- [8]
Cameras are often installed by facilities or operations teams working outside formal security processes, powered on, connected to the network, and left with minimal monitoring or maintenance.
- [9]
The AIVD and MIVD advisory confirmed that attackers use automated image-recognition tools to search footage for military vehicles, cargo, and personnel without manually reviewing every frame.
- [10]
Automated scanning finds vulnerable cameras at scale.
- [11]
Alexander Leslie of Recorded Future characterized the trend as the conversion of civilian surveillance into wartime intelligence collection, according to Wall Street Journal reporting.
ReportedSupportedSource: Alexander Leslie, Recorded Future, via Wall Street Journal and Gadget ReviewView cited source - [12]
According to Gadget Review, the attackers logged in using credentials the device had shipped with and that no one had changed.
- [13]
Ukraine-supporting hackers from Team OneFist took control of a camera in Sevastopol, rotated it across the Black Sea, and tracked a Russian military helicopter to what they described as a previously unknown air base, according to Wall Street Journal reporting.
- [14]
Ukrainian forces later struck the air base site, damaging aircraft and air-defense systems, according to the same Wall Street Journal reporting.
- [15]
Team OneFist also reportedly monitored cameras near the Kerch Strait Bridge to help refine attack planning.
- [16]
Camera makers can require unique credentials at first setup rather than relying on users to change factory defaults, publish clear end-of-support dates, disable remote-access features by default, and build firmware update prompts that users cannot permanently dismiss.
- [17]
Cloud-video providers can flag anomalous login behavior, and retailers can set minimum security baselines as a condition of stocking a product.
Sources
1 independent publisher whose own reporting we read for this story.
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Entities
- Gadget ReviewFollow
- The Wall Street JournalFollow
- Israel National Cyber DirectorateFollow
- Team OneFistFollow
- AIVD and MIVDFollow
- S-RMFollow
- Palo Alto NetworksFollow
- Recorded FutureFollow
- Alexander LeslieFollow
- Ukraine's Security ServiceFollow