- Category
- Latest news
Russian Military Intel Hacked Security Cameras in Romania to Track Ukraine Aid
- Authors
![Photo of Liubava Petriv]( "Photo of Liubava Petriv")
An international investigation has revealed that Romania was a major target in a cyber-espionage campaign orchestrated by Russia’s military intelligence agency, the GRU, aimed at monitoring the movement of Western aid into Ukraine.
The findings, reported by RFE/RL on May 23, indicate that Russian hackers sought to compromise surveillance infrastructure in NATO countries near Ukraine’s borders.
The operation, attributed to the GRU’s Unit 26165—also known as APT28 or Fancy Bear—focused on exploiting vulnerabilities in surveillance cameras.
According to investigators, nearly 1,000 of the roughly 10,000 compromised IP addresses were linked to Romanian systems, making Romania the second most-affected country after Ukraine.
Using spear-phishing emails and malware disguised in explicit content, the hackers gained access to critical data from the cameras, including locations, user credentials, and software details. This allowed them to observe, in real time, strategic sites such as border crossings and ports that have played a vital role in transporting humanitarian and military aid to Ukraine.
“The goal was to gather intelligence on the routes and timing of Western support shipments,” investigators stated.
Romania’s geographic position and 650-kilometer border with Ukraine make it a key corridor for aid delivery. Heavily trafficked areas such as Siret, Sighetu Marmației, Galați, and Danube ports have been under heightened scrutiny since the start of the war.
The investigation also highlights Romania’s use of Chinese-manufactured surveillance equipment, notably from Hikvision and Dahua—brands that have been restricted in several Western nations over security concerns. These cameras remain in use at Romanian government and military facilities.
Romania’s Ministry of National Defence responded to RFE/RL’s inquiry by noting that it “does not have regulatory or oversight authority regarding the installation and operation of surveillance systems by individuals or legal entities in Romania.”
However, it confirmed that appropriate authorities are taking “necessary measures to prevent the unauthorized collection of information not intended for public disclosure regarding its military units and their activities.”
Romanian intelligence services were not involved in the multinational investigation, which included participation from the US, UK, Germany, France, Poland, Estonia, and the Czech Republic. The Romanian Intelligence Service and the Directorate for Cybersecurity have not yet issued public statements.
Earlier, it was reported that elected President of Romania, Nicușor Dan, believes Romania can provide significant operational support to Western allies as part of a potential deterrence contingent in Ukraine, but should not directly participate in it.
