Hunt.io stumbled onto two open directories tied to Russian-speaking operators targeting Ukraine. The first hosted a custom “camview” platform popping internet-exposed Dahua and Hikvision cameras via years-old vulnerabilities, alongside SQL injection against Ukrainian government and military sites; the second, separately run but linked by shared scanning tooling, hunted for TP-Link and Asus routers across 15 European countries (mostly NATO members, plus Ukraine) to turn into SOCKS5 proxies, though Hunt.io found no sign any of that worked. Under the hood, camview mostly wraps Ingram, a public webcam vulnerability scanner whose target list includes Hikvision’s CVE-2021-36260 and Dahua’s CVE-2021-33044. As the researchers gently note, strong credentials, current firmware, and not exposing devices that don’t need it would have stopped the whole thing. That advice is roughly as old as the CVEs being exploited.
