Eyes on the Front: Iranian Threat Actors Weaponize IP Cameras in Middle East Conflict

Check Point Research documents an intensified campaign by Iranian-nexus actors compromising networked IP cameras across Israel, UAE, Qatar, Bahrain, Kuwait, Lebanon, and Cyprus to enable real-time reconnaissance and battle-damage assessment for missile operations. The actors exploit well-known CVEs in Hikvision and Dahua products (including CVE-2017-7921, CVE-2021-36260, CVE-2021-33044, CVE-2025-34067); although patches exist, many devices remain exposed, and targeting spikes correlate with significant regional events, suggesting potential kinetic follow-on activity.