Surge in Attacks on Surveillance Cameras Linked to Iranian Hackers

Check Point Research observed a coordinated campaign beginning in late February targeting Hikvision and Dahua internet-connected surveillance cameras across Israel, Qatar, Bahrain, Kuwait, the UAE, Cyprus and parts of Lebanon. The activity—attributed to Iran-linked infrastructure using commercial VPN exit nodes and VPS—focused on scanning and exploiting known authentication-bypass and RCE vulnerabilities (e.g., CVE-2021-33044, CVE-2017-7921) and is assessed as supporting operational planning and battle-damage assessment; mitigations include removing WAN exposure, enforcing strong credentials, patching firmware, VLAN segmentation, and monitoring for unusual access.