Iranian Hackers Use Compromised Cameras for Regional Surveillance

Iran-linked cyber activity is actively targeting Western organizations and Middle Eastern camera infrastructure: MuddyWater maintained access to US/Canadian targets using new backdoors (Dindoor on Deno and Python-based Fakeset) and Rclone exfiltration; Iran‑linked operators exploited known Hikvision/Dahua vulnerabilities to turn cameras into ISR sensors across multiple countries; and hacktivist proxy Handala claimed large-scale Intune-based remote wipes and theft from Stryker, illustrating a persistent but constrained Iranian cyber ecosystem.