<div id="body">
Multiple Iranian hacking crews have been targeting internet-connected surveillance cameras across Israel and other Middle Eastern countries since the war started on February 28, according to Check Point security researchers.
The Tel Aviv-based security shop has tracked &#34;hundreds&#34; of attempts to exploit a handful of bugs in IP cameras made by two manufacturers, Hikvision and Dahua, according to Sergey Shykevich, threat intelligence group manager at Check Point Research, in a conversation with El Reg.
The countries targeted in these digital intrusion attempts - Israel, Qatar, Bahrain, Kuwait, the UAE, Cyprus, and Lebanon - are the same ones that have seen significant missile activity linked to Iran. 

Iran traditionally uses digital reconnaissance - including compromised cameras - to prepare for physical attacks. As recently as June 2025, threat groups linked to Iran's Ministry of Intelligence and Security (MOIS) compromised servers containing live CCTV streams from Jerusalem, allowing the crew to surveil the city for potential targets, just days before launching missile attacks against Jerusalem. 


This more recent camera-targeting activity from infrastructure attributed to &#34;several Iran-nexus threat actors&#34; may be an &#34;early indicator of potential follow-on kinetic activity,&#34; Check Point researchers said in a Wednesday threat intelligence report.
According to the security shop, the attack infrastructure combined commercial VPN exit nodes - including Mullvad, ProtonVPN, Surfshark, and NordVPN - and virtual private servers, which the Iranians used to scan for vulnerabilities in two specific surveillance camera brands: Hikvision and Dahua.

&#34;No attempts to interact with other camera vendors were observed from this infrastructure,&#34; the researchers wrote.
The vulnerabilities include:
<ul>
<li>An improper authentication vulnerability in Hikvision IP camera firmware (CVE-2017-7921)</li>
<li>A command injection vulnerability in the Hikvision web server component (CVE-2021-36260)</li>
<li>An OS command injection vulnerability in Hikvision Intercom Broadcasting System (CVE-2023-6895)</li>
<li>An unauthenticated remote code execution vulnerability in Hikvision Integrated Security Management Platform (CVE-2025-34067)</li>
<li>An authentication bypass vulnerability in multiple Dahua products (CVE-2021-33044)</li>
</ul>
All of these security flaws have patches.
Check Point reports it tracked similar targeting during the 12-day war between Israel and Iran in June 2025, likely to support battle damage assessment. In one such case, Iran hit Israel's Weizmann Institute of Science with a ballistic missile shortly after reportedly compromising a street camera facing the building.
<ul>
<li>Iran's cyberwar has begun</li>
<li>Iran-linked crew used custom 'cyberweapon' in US critical infrastructure attacks</li>
<li>Amazon security boss: Hostile countries use cyber targeting for physical military strikes</li>
<li>Iran-linked crew used custom 'cyberweapon' in US critical infrastructure attacks</li>
</ul>
The threat hunters urged defenders to update camera firmware and software to the latest patched versions, and remove direct WAN access so cameras aren't exposed to the public internet. They also suggested isolating cameras on a dedicated VLAN with no lateral access to corporate or operational technology networks, and monitoring for repeated login failures or unexpected remote logins.
Shykevich told us Check Point hasn't yet observed any attacks or attempts against US targets, but &#34;we assess it can expand in the upcoming days or weeks.&#34;
All of Iran's cyber activity to date during this military conflict has targeted Israel and other Persian Gulf countries, with the bulk of it being disinformation attempts, cyberespionage, and distributed denial of service attempts by Iran's many hacktivist crews. While some of these government-linked hacktivists do have the capabilities to launch destructive cyberattacks, their intrusions are typically more for show and Telegram video bragging rights, with attackers exaggerating their success.

In addition to Iranian hacktivist groups, Palo Alto Networks' Unit 42 threat intel team has tracked an uptick in pro-Russian hacktivists over the past week, senior manager Justin Moore told The Register.
This, he said, is &#34;effectively expanding the Middle East's attack surface, and potentially exposing regional infrastructure to high-disruption tactics historically used by these groups against NATO and European interests.&#34; ® 
</div>

大华股份

CYBR

IHAK

网络安全 ETF - GlobalX

纳斯达克网络安全 ETF - First Trust

Check Point 软件

以色列科技 BlueStar ETF -ETFMG

以色列 MSCI ETF - iShares

海康威视

根据 Check Point 安全研究人员的报告，自 2 月 28 日以来，多个伊朗黑客团队已针对以色列及其他中东国家的互联网连接监控摄像头。他们追踪到数百次试图利用海康威视和大华股份摄像头漏洞的攻击。这些目标国家包括以色列、卡塔尔、巴林、科威特、阿联酋、塞浦路斯和黎巴嫩，这与与伊朗相关的导弹活动相吻合。这一活动可能表明潜在的后续攻击。Check Point 呼吁防御者更新摄像头固件，并将摄像头与公共访问隔离，以增强安全性

'Hundreds' of Iranian hacking attempts have hit surveillance cameras since the missile strikes

The Register

Cyber-ARK Software

Cybersecurity&Tech ETF - iShares

自导弹袭击以来，伊朗的 ‘数百次’ 黑客攻击已经影响了监控摄像头