'Hundreds' of Iranian hacking attempts hit IP cameras

"Multiple Iranian hacking crews have been targeting internet-connected surveillance cameras across Israel and other Middle Eastern countries since the war started on February 28, according to Check Point security researchers. The Tel Aviv-based security shop has tracked "hundreds" of attempts to exploit a handful of bugs in IP cameras made by two manufacturers, Hikvision and Dahua."

"Iran traditionally uses digital reconnaissance - including compromised cameras - to prepare for physical attacks. As recently as June 2025, threat groups linked to Iran's Ministry of Intelligence and Security (MOIS) compromised servers containing live CCTV streams from Jerusalem, allowing the crew to surveil the city for potential targets, just days before launching missile attacks against Jerusalem."

"This more recent camera-targeting activity from infrastructure attributed to "several Iran-nexus threat actors" may be an "early indicator of potential follow-on kinetic activity," Check Point researchers said in a Wednesday threat intelligence report. The attack infrastructure combined commercial VPN exit nodes and virtual private servers, which the Iranians used to scan for vulnerabilities in two specific surveillance camera brands: Hikvision and Dahua."

Multiple Iranian hacking crews have conducted hundreds of exploitation attempts against internet-connected surveillance cameras across Israel, Qatar, Bahrain, Kuwait, the UAE, Cyprus, and Lebanon since late February. The attacks target specific vulnerabilities in IP cameras manufactured by Hikvision and Dahua. Check Point researchers identified attack infrastructure using commercial VPN services and virtual private servers. Iran historically uses digital reconnaissance, including compromised cameras, to gather intelligence before launching physical attacks. In June 2025, Iranian-linked threat groups compromised CCTV servers in Jerusalem days before missile strikes. Security researchers assess this camera-targeting activity as a potential early indicator of follow-on kinetic military activity.

Read at Theregister