Iran-linked cyber activity escalates alongside Middle East hostilities, including IP camera targeting and DDoS campaigns

Iran-attributed cyber activity increased alongside escalating Middle East hostilities, with researchers reporting intensified targeting of internet-connected IP cameras across Israel, Qatar, Bahrain, Kuwait, the UAE, Cyprus, and later specific areas in Lebanon. Check Point assessed the activity as consistent with Iranian doctrine of leveraging compromised cameras for operational support and battle damage assessment (BDA) tied to missile operations, noting that tracking camera-targeting infrastructure may provide early warning of potential follow-on kinetic activity.

Separately, Radware reported 149 Iran-linked DDoS attacks observed between Feb 28 and Mar 2, largely aimed at government entities in the Middle East, and attributed most activity to three hacktivist groups: Keymous+, DieNet, and Conquerors Electronic Army. Additional OSINT-driven infrastructure analysis described broader Iranian state-aligned clustering using indicators such as ASN patterns and TLS fingerprints to map suspected operational infrastructure, while commentary from industry sources emphasized that destructive “wiper” malware remains a key concern (citing families including ZeroCleare, Meteor, Dustman, DEADWOOD, and Apostle). A separate ransomware “monthly state” roundup and a detection-engineering newsletter were not specific to this Iran/Middle East activity and do not materially support the incident reporting.