Iranian Hackers Exploit Surveillance Cameras in Middle East Ahead of Potential Attacks Since February 28, Iranian-linked hacking groups have targeted internet-connected surveillance cameras in Israel and other Middle Eastern nations, according to Check Point Research. The campaign, attributed to multiple Iran-nexus threat actors, has involved hundreds of exploitation attempts against vulnerabilities in Hikvision and Dahua IP cameras brands widely used across the region. The targeted countries Israel, Qatar, Bahrain, Kuwait, the UAE, Cyprus, and Lebanon align with areas experiencing heightened missile activity tied to Iran. Security researchers warn that such cyber intrusions may serve as reconnaissance for future kinetic strikes, a tactic Iran has employed in the past. In June 2025, Iranian operatives compromised CCTV servers in Jerusalem days before missile attacks, using live feeds to assess potential targets. The attack infrastructure leveraged commercial VPNs (Mullvad, ProtonVPN, Surfshark, NordVPN) and virtual private servers to scan for unpatched flaws, including: - Hikvision vulnerabilities: CVE-2017-7921 (authentication bypass), CVE-2021-36260 (command injection), CVE-2023-6895 (OS command injection), and CVE-2025-34067 (remote code execution). - Dahua vulnerability: CVE-2021-33044 (authentication bypass). All identified flaws have available patches. Check Point noted similar activity during the June 2025 Israel-Iran conflict, where compromised cameras aided battle damage assessments. In one instance, a street camera facing Israel’s Weizmann Institute was breached shortly before a missile strike on the facility. While Iranian cyber operations have so far focused on espionage, disinformation, and DDoS attacks often amplified by hacktivist groups for propaganda pro-Russian hacktivists have also increased activity in the region. Palo Alto Networks’ Unit 42 warns this could expand the Middle East’s attack surface, introducing disruptive tactics historically used against NATO and European targets. Check Point has not observed attacks on U.S. infrastructure but assesses the threat may broaden in the coming weeks.