Threat Actors Intensify Targeting of IP Cameras Across Middle East Amid Ongoing Conflict

Since February 28, 2026, Iran-linked actors have conducted a coordinated campaign compromising internet-connected Hikvision and Dahua cameras across Israel, the UAE, Qatar, Bahrain, Kuwait, Lebanon, and Cyprus by exploiting five known vulnerabilities (CVE-2017-7921, CVE-2021-36260, CVE-2023-6895, CVE-2025-34067, CVE-2021-33044). Activity correlated with geopolitical events, leveraged commercial VPN exit nodes and VPS to obscure origins, and is reported to have supported kinetic operations (e.g., surveillance used for battle damage assessment and target correction); patches exist but many devices remain unpatched and directly exposed. Recommended mitigations include removing devices from direct internet access, placing them behind VPN or zero-trust gateways, updating firmware, replacing default credentials, isolating cameras on VLANs, and monitoring for anomalous access and outbound connections.