Cameras Hacked by Team OneFist in 2022 Helped Target Airplanes and Air Defense Systems in Crimea — WSJ

The Wall Street Journal reported this in an article about the use of civilian cameras in modern warfare.

Thanks to the camera, the hackers were able to identify a Russian airbase previously unknown to them, and they passed this information on to the Ukrainian military.

The camera was mounted on a tall building in the western part of Sevastopol and offered a view of the surrounding area and the Black Sea. The hackers could remotely adjust its field of view and zoom in on the image, monitoring Russian helicopters, ships, and submarines.

According to the WSJ, after tracking one of the military helicopters, the group discovered a previously unknown Russian airbase near the local airport.

Team OneFist passed the intelligence it gathered on to Ukraine. Shortly thereafter, strikes were launched against the facility, which, according to the WSJ, damaged Russian aircraft and air defense systems.

Team OneFist also gained access to cameras near the Kerch Bridge, which they used to monitor Russian security measures. In particular, the hackers discovered motion sensors installed under the bridge, designed to detect attacks from the water.

Russia is employing a similar approach against Ukraine. In January 2024, the Security Service of Ukraine officially reported that Russian intelligence services had compromised two webcams in Kyiv, allowing the enemy to monitor air defense operations and critical infrastructure.

The Russians remotely reconfigured one of the cameras and connected it to YouTube to stream the footage. The SSU noted that the information could have been used to plan and adjust strikes on the capital.

The use of cameras for Russian intelligence is not limited to Ukrainian territory. In July 2026, the Dutch intelligence agencies AIVD and MIVD warned of systematic hacking by Russia of IP cameras in the Netherlands, other NATO countries, and Ukraine.

According to intelligence reports, the cameras were used to monitor military logistics routes and arms deliveries to Ukraine.

In May 2025, it was reported that approximately 10,000 compromised cameras were located near border crossings, train stations, and military facilities, about 80% of which were in Ukraine.