Hunt.io researchers analyzed recovered directories to understand how an operator targeted internet-exposed cameras in Ukraine. The operator utilized a custom FastAPI and Docker project named camview to scan and exploit cameras. Camview incorporates the Ingram scanner to brute-force credentials for cameras using HTTP and RTSP protocols. It also transcodes RTSP streams to MJPEG for convenient browser-based viewing. The Ingram scanner specifically targets known vulnerabilities in Hikvision, Dahua, D-Link, and Reolink cameras. Operator logs indicated live viewing sessions of 58 Ukrainian cameras, detailing session duration and frame data. A proxy script was used to authenticate with a compromised OpenCart admin panel, routing the operator's traffic through the victim's network. Separately, another directory was linked by the same Ingram scanner. This secondary operation chained TP-Link Archer vulnerabilities and MikroTik API brute-forcing to create SOCKS5 proxies. These proxies communicated with a chisel listener, although no state attribution was made.