Iranian Cyber-Kinetic Operations Targeting Surveillance and Communications Infrastructure

Reporting and analysis indicate Iranian threat actors have increasingly integrated cyber operations with kinetic objectives following the Feb. 28 U.S.-Israel strikes on Iran. Check Point Research assessed intensified targeting of IP cameras—notably devices from Hikvision and Dahua—across Israel and parts of the Gulf (including Qatar, Bahrain, Kuwait, the UAE, and Cyprus), with activity patterns suggesting use for operational support and battle damage assessment tied to missile launches; the research highlights that monitoring camera-targeting infrastructure may provide early warning of follow-on kinetic activity. Separately, commentary on Iranian cyber posture argues the apparent “quiet” is not simply loss of capability, describing a resilient, decentralized operating model and noting prior disruption to leadership and infrastructure (e.g., “Operation Epic Fury”) without eliminating Iran’s ability to conduct operations.

Additional reporting described U.S. Cyber Command participation in coordinated cyber/space actions intended to disrupt Iranian communications and sensor networks during the opening phase of hostilities, and cited claims (attributed to external reporting) that compromised traffic cameras and penetrated mobile networks were used to support real-time intelligence for targeting decisions in Tehran. Other items in the set cover unrelated law-enforcement actions against cybercrime services (e.g., takedowns of Tycoon2FA and LeakBase, and a Phobos ransomware guilty plea), a separate report on suspected DPRK-linked intrusions against cryptocurrency firms, and a general discussion of ransomware market dynamics post-LockBit; these do not materially add to the Iran cyber-kinetic camera/communications targeting narrative.