'Hundreds' of Iranian hacking attempts have hit surveillance cameras since the missile strikes

Check Point researchers observed multiple Iran-nexus threat actors scanning for and attempting to exploit known vulnerabilities in Hikvision and Dahua IP cameras across Israel and several Middle Eastern countries since February 28; the activity used commercial VPN exit nodes and VPS and may indicate reconnaissance supporting kinetic attacks. Researchers attributed hundreds of attempts to exploit specific CVEs (including CVE-2017-7921, CVE-2021-36260, CVE-2023-6895, CVE-2025-34067, CVE-2021-33044), noted previous successful compromises tied to missile strikes, and recommended patching, removing WAN exposure, network segmentation, and monitoring for suspicious logins.