Check Point Research documents a campaign by Iran-nexus threat actors targeting IP cameras across Israel, UAE, Qatar, Bahrain, Kuwait, Lebanon, and Cyprus. Activity spiked starting February 28 and correlates with geopolitical events including the 12-day Israel-Iran conflict in June 2025. Attackers exploited known vulnerabilities in Hikvision and Dahua cameras (CVE-2017-7921, CVE-2021-36260, CVE-2023-6895, CVE-2025-34067, CVE-2021-33044) using commercial VPN exit nodes and VPS infrastructure. The camera compromises are assessed to support battle damage assessment and target correction for physical military operations, with one documented case of Iran controlling a street camera before a ballistic missile strike on Israel's Weizmann Institute.
