EDITORIAL: 50,000 cameras hacked by Moscow in Europe — cyberwarfare has changed in scale

June 21, 2026: Mash lifts the veil

On June 21, 2026, Russian media outlet Mash — considered close to Russian intelligence services — reveals that Russian hackers have compromised 50,000 surveillance cameras in Eastern Europe. These cameras are now being used with active AI capable of facial recognition, licence plate reading, and vehicle and clothing colour identification. The presumed objective: to monitor allied military movements and identify Western advisers and instructors in Ukraine.

Fifty thousand cameras. This is not a targeted attack on a specific infrastructure. It is a mass surveillance network built silently in apartment buildings, intersections, businesses, and airports — by hackers who exploited the vulnerabilities of poorly secured systems to create large-scale passive human intelligence. This is industrial espionage in the digital age.

Why this editorial is necessary

This editorial defends a simple thesis: we are not sufficiently prepared. Not governments, not businesses, not citizens. The Mash revelation is not an isolated incident — it is a symptom of systemic vulnerability that experts have been flagging for years and that political decision-makers have not yet addressed with the urgency it requires. It is time to shift gears.

Cyberwarfare is no longer an abstract threat for information security specialists. It is playing out in the streets of Warsaw, Tallinn, Bucharest — on cameras you never look at but which may be watching you on Moscow's behalf.

50,000 cameras. I re-read that figure. 50,000 Russian eyes in Eastern Europe's streets, equipped with AI that never sleeps, never tires, never needs a visa. This revelation should be making the front page of every newspaper on the continent. Instead, it is drowned in the news cycle.

A mass surveillance network at low cost

To grasp the scale of this intrusion, one must understand how a modern surveillance camera system works. An IP camera — the most common type in public and commercial spaces — is connected to the internet. When it is poorly configured, with unchanged default passwords or unpatched firmware, it is accessible from anywhere in the world.

Specialised search engines — Shodan, Censys — allow anyone to discover millions of poorly secured cameras in seconds. Russian hackers with automated tools can compromise tens of thousands of these cameras in days. The operational cost of this attack is minimal — but its intelligence return is considerable.

AI in the service of military surveillance

What makes this attack particularly dangerous is the integration of AI into image processing. Facial recognition AI can identify known individuals — allied military officers, Western advisers, liaison personnel — from databases of public or stolen photographs. Automated licence plate reading allows tracking the movements of military vehicles across countries.

Identification by vehicle and clothing colour completes this system — allowing convoys or individuals to be tracked even when image resolution does not permit facial identification. By combining these three levels of analysis, Russian hackers can create a detailed intelligence picture of military movements in countries bordering Ukraine — without ever needing a human agent on the ground.

When I think of Western military advisers in Ukraine, the instructors training Ukrainian soldiers, the liaison officers — I wonder how many are aware that their faces, their vehicles, their movement habits may already be in a Russian database assembled from hacked surveillance cameras. That is a disturbing reality.

The UK NCSC sounds the alarm

The revelation about hacked cameras fits into a context of sharply rising state cyber threats. According to the UK National Cyber Security Centre (NCSC), documented by Security Matters Magazine (June 20, 2026), 75% of cyberattacks targeting UK critical infrastructure are now linked to hostile states — Russia at the top, followed by China and Iran.

That figure is striking. Three quarters of attacks on power plants, water distribution systems, transport networks, and British hospitals are not the work of cybercriminals seeking a ransom — they are deliberate acts of espionage or pre-positioning for future offensive actions. The boundary between peacetime and a state of latent war has dissolved in cyberspace.

The NCSC's 2028 forecast: AI and OT vulnerabilities

The NCSC goes further with a troubling forecast: by 2028, AI will enable large-scale exploitation of vulnerabilities in legacy OT systems (Operational Technology — industrial control systems in critical infrastructure). These systems — often twenty or thirty years old — were never designed to withstand sophisticated digital attacks.

An attacker equipped with AI capable of automatically identifying vulnerabilities in these systems could, in theory, simultaneously compromise dozens of power plants, water treatment facilities, and gas networks across a country. This is the catastrophic cyberwarfare scenario — and the NCSC says it will be technically feasible in two years.

2028 for a mass cyberattack on OT infrastructure — that is two years away. Two years to secure thirty-year-old industrial systems, dispersed across thousands of sites, managed by operators who are not cybersecurity experts. I am not optimistic about our ability to get there in time.

AI weaponises vulnerabilities in hours

In the United States, the Binding Operational Directive 26-04 from CISA (Cybersecurity and Infrastructure Security Agency), published on June 10, 2026, officially acknowledges that AI can "weaponise" vulnerabilities in hours. This directive — applying to all American federal agencies — drastically shortens required remediation timelines.

Before AI, exploiting a newly discovered vulnerability typically required days or weeks of development. With generative AI tools applied to exploit code, this window can be reduced to hours. Defenders following multi-week remediation cycles find themselves structurally behind attackers operating at AI speed.

The directive as a partial admission of helplessness

CISA BOD 26-04 is also a partial admission of helplessness: it implicitly acknowledges that current remediation procedures are no longer adapted to the pace of AI-assisted attacks. It imposes new rules — but those rules presuppose that government organisations have the human and technical resources to implement them.

For the tens of thousands of companies and organisations that do not fall under CISA's mandate — small and medium businesses, local authorities, private infrastructure operators — no directive applies. That is where surveillance cameras are. That is where legacy OT systems are. That is where Russian hackers operate.

CISA shortening remediation timelines — that is good. But it is like strengthening the locks on ministry doors while Russian hackers come through the garage doors of subcontractors. Cybersecurity's chain is only as strong as its weakest link. And the weakest link is always the least protected.

Attack speed becomes inhuman

According to the OriginBrief report (June 22, 2026), in 2026 the attackers' cybercriminal "breakout time" has fallen to just 27 seconds. "Breakout time" measures the delay between an initial system compromise and the moment the attacker expands access to other parts of the target network.

Twenty-seven seconds. That is less time than it takes for IT security staff to be alerted to an anomaly, let alone make a decision and act. An attacker who penetrates a network at 2:00 PM can have compromised the entire system before the alert is read at 2:00:27. In this environment, real-time AI detection is not a luxury — it is the only technically credible response.

AI-assisted cyberattacks up 89%

AI-assisted cyberattacks have increased 89% year-on-year according to the same OriginBrief data. This figure covers both state and criminal attacks. It reflects the mass adoption of AI tools to automate all attack phases: reconnaissance, exploitation, lateral movement, exfiltration.

For states like Russia or China, AI transforms cyberwarfare from a labour-intensive activity requiring highly skilled personnel into a massively scalable capability. With the right AI tools, a team of a few dozen hackers can conduct operations that would have required thousands of people five years ago. The cost-effectiveness ratio of cyberattacks has radically shifted in favour of attackers.

89% increase in AI cyberattacks in one year. 27-second breakout time. These figures describe an environment where defenders are structurally behind. This is not a question of competence — it is a question of information physics. AI attacks faster than humans can react.

Securing cameras and IoT as a national priority

The revelation of 50,000 hacked cameras demands an urgent policy response. Every European country must impose minimum security standards for IP cameras and connected IoT (Internet of Things) devices on public networks. Passwords mandatorily changed at installation, automatic firmware updates, disabling unnecessary remote access — these are basic measures that would have drastically reduced the attack surface exploited by Russian hackers.

The EU's NIS2 Directive, in force since 2023, imposes cybersecurity requirements on essential infrastructure operators. But small surveillance camera installers in residential buildings do not fall within its scope. Regulation must be extended to connected surveillance equipment in at-risk areas — borders, military bases, sensitive industrial zones.

Cyber intelligence as active defence

Passive defence — fixing vulnerabilities, securing equipment — is no longer sufficient. European countries must invest in active cyber intelligence: identifying Russian and Chinese attack infrastructure, mapping it, disrupting it before it is used. This is what UK GCHQ, the US NSA, and a few European agencies already do — but not with adequate resources.

The CyberNetSec report (June 24, 2026) documents Five Eyes warnings about active cyber threats. This intelligence alliance — the United States, United Kingdom, Canada, Australia, New Zealand — shares threat information in near-real time. The European Union should systematise its integration into these intelligence flows for all its members.

Five Eyes shares cyber intelligence. The EU has 27 national agencies cooperating imperfectly. Meanwhile, Russian hackers operate as if there were no borders. Our cyber defence architecture is an anachronism — scaled to our national borders, while the threat is global.

Ukraine as a cybersecurity laboratory

Ukraine has been, since 2014 and even more intensively since 2022, the most targeted country by Russian cyberattacks in the world. Dozens of major attacks — some temporarily taking essential services offline — have been documented and attributed to groups linked to the Russian GRU and FSB.

But Ukraine has developed, through this adversity, one of the most advanced cyber defence capabilities in the world. Its Cyber Emergency Response Team, supported by Microsoft, Google, Amazon, and other Western tech giants, has developed detection and resistance methods that set the reference standard. Europeans should systematically learn from Ukraine's experience.

Cooperation as an imperative

The Russian hackers who compromised 50,000 cameras do not distinguish between a Polish, Estonian, or Romanian camera. Their network covers all of Eastern Europe — it transcends national borders. The response cannot be national — it must be collective.

ENISA (EU Agency for Cybersecurity) has the technical competence to coordinate a European response. But it lacks resources, strong mandates, and direct action capacity. A strengthened ENISA is needed, equipped with intervention powers in member states in the event of a state-sponsored attack, and offensive intelligence capabilities to disrupt adversary attack infrastructure.

ENISA as it exists today is an advisory agency, not a cyberwarfare agency. Against Russian hackers operating with state resources and AI tools, advice is no longer enough. Power is needed. And power requires a mandate, resources, and the political will to use them.

ENISA and the limits of European cyber governance

ENISA (EU Agency for Cybersecurity) is technically competent but structurally limited. It has no direct action mandate in member states, no offensive capabilities, and resources inferior to those of a single large private cybersecurity firm. Against Russian hackers operating with state resources and sophisticated AI tools, this response level is structurally insufficient.

The EU's NIS2 Directive, in force since 2023, imposes cybersecurity requirements on essential infrastructure operators. But small surveillance camera installers in residential buildings do not fall within its scope. Regulation must be extended to connected surveillance equipment in at-risk areas — borders, military bases, sensitive industrial zones near the EU's eastern borders.

Five Eyes cooperation and European integration into cyber intelligence

The CyberNetSec report of June 24, 2026 documents Five Eyes warnings on active cyber threats. This intelligence alliance — the United States, United Kingdom, Canada, Australia, New Zealand — shares threat information in near-real time. The European Union should systematise its integration into these intelligence flows for all its members, which requires formal sharing agreements that not all member states have yet signed.

Ukraine, as our file notes, has become the most targeted country by Russian state cyberattacks in the world. It has developed, through this adversity, one of the most advanced cyber defence capabilities available. Europeans should systematise the sharing of experience with the Ukrainian cyber team, supported by Microsoft, Google, and Amazon. These operational practices developed under real fire are infinitely valuable.

Ukraine is developing its cyber defence under bombardment. Europe is developing its own in committee meetings. The difference in context creates a difference in priority and urgency that explains why Ukraine is sometimes more technically advanced than much wealthier European countries.50,000 cameras hacked — and Europe's collective response is still to come. This editorial argues for urgency. But I must be honest: I do not know whether European decision-makers have truly grasped the scale of the threat. I hope I am wrong. Ukraine hopes so too.

This editorial's call to action

This editorial defends a simple, urgent position: Europe — its governments, businesses, and citizens — must treat cybersecurity as a top national priority, on par with conventional defence. The 50,000 hacked cameras, the 75% of UK critical infrastructure attacks linked to hostile states, the 89% rise in AI cyberattacks, the 27-second breakout time — these figures describe a wartime reality, not a hypothetical threat.

Putin does not need to send soldiers to Western Europe to begin destabilising its societies. He only needs to maintain active cyber capabilities — cheap, deniable, with no direct risk of military retaliation. Hybrid cyberwarfare is the first front of the war against the West — and it is a front on which we are falling unacceptably behind.

What this editorial defends

This editorial defends the thesis that digital freedom and security are fundamental rights that must be protected by active public policies. It also defends the thesis that Moscow is waging permanent hybrid warfare against European democracies — and that ignoring this fact out of comfort or fear of escalation is a dangerous policy.

Zelensky resists Russian missiles and drones with courage that commands the admiration of the entire world. Europe, for its part, must resist Russian hackers with the resources, regulations, and political will that are still too often lacking. That is the minimum we owe to all those fighting for our common freedom.

By Maxime Marquette, columnist

Editorial stance

I am not a journalist but a columnist and analyst. My expertise lies in observing and analysing the geopolitical, economic and strategic dynamics that shape our world. My work is to take political strategies apart, to understand global economic movements, to put the decisions of international actors in context and to offer analytical perspectives on the changes that are redefining our societies.

I do not claim the cold objectivity of traditional journalism, which stops at reporting facts. I claim analytical clarity, rigorous interpretation and a deep understanding of the complex issues that concern us all. My role is to give meaning to the facts, to place them in their historical and strategic context, and to offer a critical reading of events.

Method and sources

This text keeps the basic distinction between verified facts and interpretive analysis. The rule never changes: a factual claim is published only when a verifiable source supports it, and the sources this article actually used are listed under Sources, never here.

Primary source families used by the publication, when the story has them: official statements from governments and international institutions, public statements by political leaders, reports from intergovernmental organisations, dispatches from recognised international news agencies.

Secondary source families: specialised publications, internationally recognised news media, analyses from established research institutions, reports from industry organisations.

When an article cites statistical, economic or geopolitical data, it comes from the institutions that produce it (intergovernmental organisations, central banks, national statistics offices), and the exact institution is named under Sources.

Nature of the analysis

The analyses, interpretations and perspectives in the analytical sections of this article are a critical, contextual synthesis based on the information available, the trends observed and the expert comments cited in the sources consulted.

My role is to interpret these facts, to set them in the context of today's geopolitical and economic dynamics, and to give them a coherent meaning within the larger story of the changes shaping our time. These analyses reflect expertise built through continuous observation of international affairs and an understanding of the strategic mechanisms that drive global actors.

This article describes a documented state of affairs on its publication date, not a prediction: later developments may shift its outlook. No update is promised in advance; when an article is corrected or completed, the change is dated in the text.