<div id="body">
Multiple Iranian hacking crews have been targeting internet-connected surveillance cameras across Israel and other Middle Eastern countries since the war started on February 28, according to Check Point security researchers.
The Tel Aviv-based security shop has tracked &#34;hundreds&#34; of attempts to exploit a handful of bugs in IP cameras made by two manufacturers, Hikvision and Dahua, according to Sergey Shykevich, threat intelligence group manager at Check Point Research, in a conversation with El Reg.
The countries targeted in these digital intrusion attempts - Israel, Qatar, Bahrain, Kuwait, the UAE, Cyprus, and Lebanon - are the same ones that have seen significant missile activity linked to Iran. 

Iran traditionally uses digital reconnaissance - including compromised cameras - to prepare for physical attacks. As recently as June 2025, threat groups linked to Iran's Ministry of Intelligence and Security (MOIS) compromised servers containing live CCTV streams from Jerusalem, allowing the crew to surveil the city for potential targets, just days before launching missile attacks against Jerusalem. 


This more recent camera-targeting activity from infrastructure attributed to &#34;several Iran-nexus threat actors&#34; may be an &#34;early indicator of potential follow-on kinetic activity,&#34; Check Point researchers said in a Wednesday threat intelligence report.
According to the security shop, the attack infrastructure combined commercial VPN exit nodes - including Mullvad, ProtonVPN, Surfshark, and NordVPN - and virtual private servers, which the Iranians used to scan for vulnerabilities in two specific surveillance camera brands: Hikvision and Dahua.

&#34;No attempts to interact with other camera vendors were observed from this infrastructure,&#34; the researchers wrote.
The vulnerabilities include:
<ul>
<li>An improper authentication vulnerability in Hikvision IP camera firmware (CVE-2017-7921)</li>
<li>A command injection vulnerability in the Hikvision web server component (CVE-2021-36260)</li>
<li>An OS command injection vulnerability in Hikvision Intercom Broadcasting System (CVE-2023-6895)</li>
<li>An unauthenticated remote code execution vulnerability in Hikvision Integrated Security Management Platform (CVE-2025-34067)</li>
<li>An authentication bypass vulnerability in multiple Dahua products (CVE-2021-33044)</li>
</ul>
All of these security flaws have patches.
Check Point reports it tracked similar targeting during the 12-day war between Israel and Iran in June 2025, likely to support battle damage assessment. In one such case, Iran hit Israel's Weizmann Institute of Science with a ballistic missile shortly after reportedly compromising a street camera facing the building.
<ul>
<li>Iran's cyberwar has begun</li>
<li>Iran-linked crew used custom 'cyberweapon' in US critical infrastructure attacks</li>
<li>Amazon security boss: Hostile countries use cyber targeting for physical military strikes</li>
<li>Iran-linked crew used custom 'cyberweapon' in US critical infrastructure attacks</li>
</ul>
The threat hunters urged defenders to update camera firmware and software to the latest patched versions, and remove direct WAN access so cameras aren't exposed to the public internet. They also suggested isolating cameras on a dedicated VLAN with no lateral access to corporate or operational technology networks, and monitoring for repeated login failures or unexpected remote logins.
Shykevich told us Check Point hasn't yet observed any attacks or attempts against US targets, but &#34;we assess it can expand in the upcoming days or weeks.&#34;
All of Iran's cyber activity to date during this military conflict has targeted Israel and other Persian Gulf countries, with the bulk of it being disinformation attempts, cyberespionage, and distributed denial of service attempts by Iran's many hacktivist crews. While some of these government-linked hacktivists do have the capabilities to launch destructive cyberattacks, their intrusions are typically more for show and Telegram video bragging rights, with attackers exaggerating their success.

In addition to Iranian hacktivist groups, Palo Alto Networks' Unit 42 threat intel team has tracked an uptick in pro-Russian hacktivists over the past week, senior manager Justin Moore told The Register.
This, he said, is &#34;effectively expanding the Middle East's attack surface, and potentially exposing regional infrastructure to high-disruption tactics historically used by these groups against NATO and European interests.&#34; ® 
</div>

大華股份

CYBR

IHAK

網絡安全 ETF - GlobalX

納斯達克網絡安全 ETF - First Trust

Check Point 軟件

以色列科技 BlueStar ETF -ETFMG

以色列 MSCI ETF - iShares

海康威視

根據 Check Point 安全研究人員的報告，自 2 月 28 日以來，多個伊朗黑客團隊已針對以色列及其他中東國家的互聯網連接監控攝像頭。他們追蹤到數百次試圖利用海康威視和大華股份攝像頭漏洞的攻擊。這些目標國家包括以色列、卡塔爾、巴林、科威特、阿聯酋、塞浦路斯和黎巴嫩，這與與伊朗相關的導彈活動相吻合。這一活動可能表明潛在的後續攻擊。Check Point 呼籲防禦者更新攝像頭固件，並將攝像頭與公共訪問隔離，以增強安全性

'Hundreds' of Iranian hacking attempts have hit surveillance cameras since the missile strikes

The Register

Cyber-ARK Software

Cybersecurity&Tech ETF - iShares

自導彈襲擊以來，伊朗的 ‘數百次’ 黑客攻擊已經影響了監控攝像頭