Iranian Cyber Ops Maintain US Network Footholds, Target Cameras for Regional Surveillance

Iran-linked actors—primarily the MuddyWater APT and affiliated proxies—conducted sustained espionage and battlefield intelligence operations in early 2026, maintaining persistent access to US and Canadian organizations across banking, aviation, defense supply chains, and non-profits while scanning and exploiting Hikvision and Dahua surveillance cameras across multiple Middle Eastern countries; the report documents use of multiple malware families (Dindoor, Fakeset, Stagecomp, Darkcomp), exploitation of known camera CVEs, certificate-signed malware, Rclone-based exfiltration indicators, and a claimed destructive Handala wiper attack on Stryker with ~50 TB exfiltrated.