KYIV – As Russia’s full-scale invasion of Ukraine nears the two-year mark, hundreds of thousands of Chinese-made Hikvision and Dahua video-surveillance cameras, used by government-run security systems, residences, and private companies throughout Ukraine, heighten the risks of attacks by the Russian military, Ukrainian digital-security experts and government officials fear.

When Russian missiles struck Kyiv in a January 2 attack that killed at least three people, two ordinary outdoor CCTV cameras – one for a condominium, the other for a parking lot — helped guide their way, the State Security Service of Ukraine (SBU) claims.

After hacking the cameras, Russian intelligence used them “to spy on the Defense Forces in the capital” and to record images of “critical infrastructure facilities,” according to the SBU.

One of those cameras was a 2016 Chinese-made Hikvision device, a law enforcement official who requested anonymity because of the sensitivity of the subject told Schemes, the investigative unit of RFE/RL’s Ukrainian Service.

“Such cameras are usually just connected to the Internet and are already relatively outdated — that is, with software that has not been updated for a long time and has many known vulnerabilities,” said Serhiy Denysenko, executive director of the Ukrainian information-security company CyberLab’s Digital Forensics Laboratory.

Manufacturers’ “basic” camera software means that “hackers — or, in this case, the Russian special services – who are scanning the Internet can find this camera and gain access to it,” Denysenko said.

To test the SBU’s claims, a Digital Forensics Laboratory specialist hacked into a 2015 Hikvision CCTV camera in about 15 minutes.

From 2014 to 2022, three Ukrainian companies imported over 875,000 CCTV cameras and other devices related to video surveillance made by Hikvision, and a single company imported nearly 1.1 million cameras and other devices related to video…