Loading story…
Amazon security leaders have revealed that nation-state actors are increasingly using cyber operations to gather intelligence that directly supports physical military actions. According to Amazon Threat Intelligence, groups such as Iran-backed Imperial Kitten and MuddyWater have conducted digital reconnaissance to identify and scope targets, with the collected data feeding into real-world kinetic strikes. Amazon's unique threat visibility, leveraging its MadPot honeypot systems, opt-in customer data, and industry partnerships, has enabled the detection of these coordinated campaigns, which blur the traditional boundaries between cyber and physical security.
This emerging threat model, described as 'cyber-enabled kinetic targeting,' requires organizations to rethink their approach to risk management, as industries not previously considered high-value targets—such as shipping, transportation, and electronics—are now at risk due to the intelligence value of their systems. Amazon's security executives emphasize that digital and physical security can no longer be siloed, urging both private and public sectors to adapt to this new operational reality where cyber intrusions are a precursor to military objectives and physical attacks.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
CloudSEK reported that Iran-linked APT35 (Charming Kitten) conducted multi-year cyber reconnaissance across GCC countries, including profiling and in some cases breaching critical infrastructure in the UAE, Saudi Arabia, Qatar, and other states. The report said the activity preceded coordinated missile strikes, suggesting the cyber operations may have supported kinetic targeting.
On November 19, 2025, Amazon published threat intelligence findings warning that nation-state actors are increasingly using cyber operations to gather targeting intelligence for real-world military strikes. The report highlighted examples involving Iran, Russia, and China and urged defenders to integrate cyber and physical security models.
Amazon reported that Iran-linked group Imperial Kitten (Tortoiseshell) conducted digital reconnaissance against a vessel's AIS platform and CCTV systems days before a failed Houthi missile strike attempt in the Red Sea. The activity was presented as a concrete example of cyber-enabled kinetic targeting against maritime assets.
Amazon Threat Intelligence said Iran-linked group MuddyWater accessed live CCTV feeds in Jerusalem to support missile targeting, illustrating cyber reconnaissance used to inform physical strikes. The reporting ties the surveillance to missile attacks on Israel, though an exact date was not provided in the references.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
7 references tracked. Mallory keeps watching after this page renders.
infosec.pub
Open sourcesecurityaffairs.com
Open sourcethehackernews.com
Open sourcego.theregister.com
Open sourceaws.amazon.com
Open sourcecsoonline.com
Open sourcecyberscoop.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Nation-state and **advanced persistent threat (APT)** activity is increasingly extending beyond traditional government and military targets to include private companies and **critical national infrastructure**. The reporting highlights a shift toward long-term intrusions aimed at intelligence collection, strategic influence, economic advantage, and disruption, with private-sector networks, infrastructure providers, and technology firms now treated as operationally valuable targets. Critical services such as energy, water, telecommunications, transport, and healthcare are described as especially exposed because attacks on even a small component can create wider societal and political effects. The coverage also emphasizes that these campaigns often avoid noisy malware or immediate disruption, instead relying on **legitimate credentials**, trusted third-party access, and existing business tools to maintain persistent access across identities, cloud platforms, SaaS environments, and supplier ecosystems. One example cited is the attack on Collins Aerospace's **ARINC cMUSE** airline check-in and boarding software, which disrupted passenger boarding at several European airports and illustrated how compromising a supporting technology provider can produce broad downstream impact. Defenders are urged to move beyond incident-driven response and strengthen continuous visibility, exposure management, and threat-informed monitoring across interconnected enterprise and infrastructure environments.
Jun 29, 2026
Multiple nation-state actors, including China, Russia, Iran, and North Korea, are intensifying cyber operations targeting critical infrastructure, government entities, and private sector organizations worldwide. China-linked groups such as Ink Dragon have expanded espionage campaigns against European governments, while Russia-linked actors like Callisto have targeted NGOs and are implicated in disruptive attacks in Europe. Iran's MuddyWater has focused on critical infrastructure in Israel and Egypt, and North Korea is increasing disruptive attacks on various sectors. These activities are accompanied by sophisticated cybercrime campaigns, exploitation of zero-day vulnerabilities, and significant data breaches affecting sectors such as health, telecommunications, and justice. In response, Western governments and institutions are taking legal and policy actions, including EU sanctions and fines, UK and Polish legal proceedings against Russian actors, and increased attribution of attacks to state-sponsored groups. However, there is growing concern that U.S. cyber defenses are lagging behind adversaries, with strained mission capacity, weakened public-private collaboration, and unstable federal leadership. Experts call for renewed strategic focus, improved coordination with allies, and robust policy reforms to counter the persistent and evolving threat landscape posed by hostile nation-states.
Jun 29, 2026
Iranian state-aligned and affiliated cyber activity has expanded beyond traditional disruptive malware into a broader campaign of **hybrid operations** that combines espionage, reconnaissance, credential abuse, and destructive effects. Reporting describes a tactical shift from bespoke wipers toward **living-off-the-land** methods, including the compromise of highly privileged identities and the use of legitimate enterprise administration capabilities to issue remote-wipe actions at scale. At the same time, Iranian operators and aligned personas have been linked to sustained access into US organizations in sectors including banking, aviation, defense-adjacent industries, and healthcare, while also targeting internet-connected surveillance infrastructure in the Middle East for intelligence collection and battlefield awareness. The activity is unfolding alongside a wider surge in hostile traffic associated with the regional conflict, with major increases in infrastructure scanning, automated reconnaissance, credential harvesting, and DDoS preparation against critical businesses, especially **banking and fintech**. One report highlights **Handala/Void Manticore** as emblematic of the disruptive trend, while another ties **MuddyWater** to persistent footholds in US networks and notes exploitation of camera vulnerabilities such as `CVE-2017-7921` and `CVE-2021-33044`. Together, the reporting indicates that Iranian cyber operations remain active and adaptive, using proxy infrastructure, compromised identities, and exposed edge devices to sustain pressure on commercial and strategic targets without relying solely on custom malware.
Jun 29, 2026