Loading story…
Israel's Prime Minister's Office published imagery and messaging portraying Benjamin Netanyahu as directing strikes against senior Iranian officials while online disinformation falsely claimed he had been killed, underscoring how the expanding Israel-Iran conflict is being accompanied by information operations and public messaging battles. Separately, Kuwait announced the arrest of a 16-member cell allegedly affiliated with Hezbollah, saying the group plotted to undermine national security and that authorities seized firearms, assassination tools, encrypted communications equipment, drones, maps, narcotics, cash, and terrorist insignia.
The South Korean case is a different law-enforcement matter: police arrested a Korean man accused of posting a bomb threat against a Detroit-area U.S. airport after an earlier dispute with airport authorities, following cooperation with U.S. Homeland Security Investigations. That incident does not share the same operational context, actors, or geography as the Middle East conflict-related reporting, and the three items do not describe a single coherent cybersecurity event; they are separate security and criminal incidents rather than a unified cyber story.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
A separate video posted by Netanyahu on X showed him walking in Jerusalem, apparently intended to rebut online claims that he had died or was incapacitated. The video itself prompted additional online speculation about possible manipulation, according to the report.
The Israeli Prime Minister's Office published a social media image showing Benjamin Netanyahu in a command setting and said he was overseeing operations against senior Iranian regime officials during the escalating Israel-Iran conflict. The post appeared amid widespread online rumors falsely claiming Netanyahu had been killed or incapacitated.
As part of the investigation, Kuwaiti authorities said they seized firearms, ammunition, an assassination weapon, encrypted Morse communication devices, drones, maps, narcotic substances, cash, and terrorist organization materials. Officials said the suspects would be referred to the Public Prosecution and that further links were still under investigation.
Kuwait announced that security authorities had uncovered a terrorist group affiliated with Hezbollah and arrested 16 people, including 14 Kuwaiti citizens and 2 Lebanese nationals. The Interior Ministry said the group was allegedly plotting to undermine state sovereignty, destabilize security, and spread chaos.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
indiatvnews.com
Open sourcekhaleejtimes.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Iran-nexus cyber activity intensified alongside regional military escalation, with multiple reporting streams describing both opportunistic and targeted operations. Check Point Research observed a coordinated campaign to compromise internet-connected **IP cameras** across Israel, the UAE, Qatar, Bahrain, Kuwait, Lebanon, and Cyprus, with spikes in exploitation attempts aligning to geopolitical events; activity was traced to infrastructure linked to Iran-nexus actors using commercial VPN exit nodes (e.g., *Mullvad*, *ProtonVPN*, *Surfshark*, *NordVPN*) and VPS infrastructure to mask origin, and the most targeted vendors were **Hikvision** and **Dahua**. Separately, Symantec reported **Seedworm** (*MuddyWater/Temp Zagros/Static Kitten*) activity on multiple U.S. and Canadian organizations beginning in February 2026, including a U.S. bank, airport, non-profit, and the Israeli operations of a U.S. software supplier to defense/aerospace; Symantec identified a previously unknown backdoor dubbed **Dindoor** (leveraging the *Deno* runtime) and a Python backdoor **Fakeset**, with malware signed using certificates issued to “**Amy Cherne**” (and in some cases “**Donald Gay**”), and noted attempted data exfiltration using **Rclone** to a *Wasabi* cloud storage bucket. Additional coverage indicates broader pro-Iranian cyber activity but is less specific to the above intrusions. ASEC’s weekly “Ransom & Dark Web Issues” roundup flags **pro-Iranian/pro-Islamist hacktivist** attacks against Middle Eastern and pro-Western targets, but provides limited technical detail in the excerpt. A podcast episode describing “Iran’s 12 days of cyber war” and global OT targeting (including *Unitronics* PLCs) is largely commentary and retrospective framing rather than a discrete, verifiable incident report, and two other items in the set (a Russia-linked **APT28** phishing/malware campaign in Ukraine and a China-nexus **UAT-9244** telecom intrusion set in South America) describe unrelated threat activity outside the Iran-focused escalation.
Jul 22, 2026
Escalating conflict following **Operation Epic Fury** (US/Israel strikes inside Iran) has coincided with increased cyber activity targeting Middle East and adjacent interests. Proofpoint reported that Iran-aligned **TA453** (*Charming Kitten / Mint Sandstorm / APT42*) continued intelligence collection during the conflict, including a **credential-phishing** attempt against a US think tank observed on **8 March**, and noted additional campaigns against Middle East government organizations with suspected links to multiple state or state-aligned actors (including suspected attribution to **China, Belarus, Pakistan, and Hamas**). Despite reported Iranian internet shutdown measures after the initial strikes, espionage-focused operations were assessed as ongoing. Check Point Research separately identified China-linked activity targeting **Qatar**, using conflict-themed lures (e.g., fake “war news”/damage imagery) to deliver malware, including **PlugX** and **Cobalt Strike**, with tradecraft described as a multi-stage chain involving a compromised server and **DLL hijacking** via a legitimate application (*Baidu NetDisk*) to load the backdoor—highlighting rapid weaponization of breaking news to target **energy** and **military** sectors. Other items in the set were not part of this conflict-driven espionage theme: one report described a Russian-speaking **‘BlackSanta’** BYOVD-based “EDR killer” delivered via HR workflow abuse and steganographic images, and a weekly threat bulletin summarized unrelated breaches and research (e.g., AkzoNobel, LexisNexis, Wikimedia worm, TriZetto, and AI-related threats).
Jun 29, 2026
Reporting and analysis indicate **Iranian threat actors** have increasingly integrated cyber operations with kinetic objectives following the Feb. 28 U.S.-Israel strikes on Iran. Check Point Research assessed intensified targeting of **IP cameras**—notably devices from **Hikvision** and **Dahua**—across Israel and parts of the Gulf (including Qatar, Bahrain, Kuwait, the UAE, and Cyprus), with activity patterns suggesting use for operational support and *battle damage assessment* tied to missile launches; the research highlights that monitoring camera-targeting infrastructure may provide early warning of follow-on kinetic activity. Separately, commentary on Iranian cyber posture argues the apparent “quiet” is not simply loss of capability, describing a resilient, decentralized operating model and noting prior disruption to leadership and infrastructure (e.g., “Operation Epic Fury”) without eliminating Iran’s ability to conduct operations. Additional reporting described U.S. Cyber Command participation in coordinated cyber/space actions intended to disrupt Iranian communications and sensor networks during the opening phase of hostilities, and cited claims (attributed to external reporting) that compromised traffic cameras and penetrated mobile networks were used to support real-time intelligence for targeting decisions in Tehran. Other items in the set cover unrelated law-enforcement actions against cybercrime services (e.g., takedowns of **Tycoon2FA** and **LeakBase**, and a **Phobos** ransomware guilty plea), a separate report on suspected **DPRK-linked** intrusions against cryptocurrency firms, and a general discussion of ransomware market dynamics post-LockBit; these do not materially add to the Iran cyber-kinetic camera/communications targeting narrative.
Jun 29, 2026