Iran-Linked Cyber Activity Escalates Amid Middle East Conflict

Iran-nexus cyber activity intensified alongside regional military escalation, with multiple reporting streams describing both opportunistic and targeted operations. Check Point Research observed a coordinated campaign to compromise internet-connected IP cameras across Israel, the UAE, Qatar, Bahrain, Kuwait, Lebanon, and Cyprus, with spikes in exploitation attempts aligning to geopolitical events; activity was traced to infrastructure linked to Iran-nexus actors using commercial VPN exit nodes (e.g., Mullvad, ProtonVPN, Surfshark, NordVPN) and VPS infrastructure to mask origin, and the most targeted vendors were Hikvision and Dahua. Separately, Symantec reported Seedworm (MuddyWater/Temp Zagros/Static Kitten) activity on multiple U.S. and Canadian organizations beginning in February 2026, including a U.S. bank, airport, non-profit, and the Israeli operations of a U.S. software supplier to defense/aerospace; Symantec identified a previously unknown backdoor dubbed Dindoor (leveraging the Deno runtime) and a Python backdoor Fakeset, with malware signed using certificates issued to “Amy Cherne” (and in some cases “Donald Gay”), and noted attempted data exfiltration using Rclone to a Wasabi cloud storage bucket.

Additional coverage indicates broader pro-Iranian cyber activity but is less specific to the above intrusions. ASEC’s weekly “Ransom & Dark Web Issues” roundup flags pro-Iranian/pro-Islamist hacktivist attacks against Middle Eastern and pro-Western targets, but provides limited technical detail in the excerpt. A podcast episode describing “Iran’s 12 days of cyber war” and global OT targeting (including Unitronics PLCs) is largely commentary and retrospective framing rather than a discrete, verifiable incident report, and two other items in the set (a Russia-linked APT28 phishing/malware campaign in Ukraine and a China-nexus UAT-9244 telecom intrusion set in South America) describe unrelated threat activity outside the Iran-focused escalation.