Analysis of Russian-Speaking Hackers' Toolkit Targeting Ukrainian IP Cameras

Hunt.io researchers analyzed open directories revealing a toolkit used by Russian-speaking operators to exploit internet-exposed cameras in Ukraine. The toolkit includes a custom camview project built with FastAPI and Docker, which scans for vulnerabilities, brute-forces credentials using 3,811 credential pairs, and transcodes RTSP streams for browser viewing. It targets known vulnerabilities (CVEs) in Hikvision, Dahua, D-Link, and Reolink cameras, with logs documenting 58 live Ukrainian camera sessions. Additionally, a separate directory contains exploits for TP-Link and MikroTik devices, repurposing them as SOCKS5 proxies.