Iranian Cyber Operations Amid Regional Conflict

On February 28, 2026, the United States and Israel initiated a significant joint military offensive, termed Operation Epic Fury and Operation Roaring Lion, respectively. In response, Iran launched a multi-vector retaliatory campaign that has escalated into a broader regional conflict. This period has seen a marked increase in cyber operations attributed to Iranian threat actors, particularly targeting IP cameras across several Middle Eastern nations, including Israel, Qatar, Bahrain, Kuwait, the United Arab Emirates (UAE), and Cyprus.

Interplay between Iranian Targeting of IP Cameras and Physical Warfare in the Middle EastThreat Brief: March 2026 Escalation of Cyber Risk Related to Iran

Research from Check Point indicates that the targeting of IP cameras, specifically from manufacturers Hikvision and Dahua, intensified significantly starting on February 28. This activity is believed to support operational objectives such as battle damage assessment (BDA) and targeting corrections during missile operations. The cyber operations observed align with geopolitical events, including heightened tensions following anti-regime protests in Iran and military visits from U.S. Central Command to Israel.

Interplay between Iranian Targeting of IP Cameras and Physical Warfare in the Middle East

The attack infrastructure utilized by Iranian actors includes commercial VPN exit nodes and virtual private servers, focusing on exploiting known vulnerabilities in the targeted camera systems. Notable vulnerabilities include CVE-2017-7921 and CVE-2021-33044, which have been actively exploited since early 2026.

Interplay between Iranian Targeting of IP Cameras and Physical Warfare in the Middle East

The cyberattacks are not limited to IP cameras; they reflect a strategic shift in Iran's military doctrine, integrating cyber capabilities with traditional warfare. The ongoing conflict has prompted various Iranian-aligned hacktivist groups to engage in disruptive operations, targeting critical infrastructure and leveraging social engineering tactics to exploit vulnerabilities in adversary systems.

Threat Brief: March 2026 Escalation of Cyber Risk Related to IranInterplay between Iranian Targeting of IP Cameras and Physical Warfare in the Middle East

Unit 42 has reported a surge in hacktivist activity, with numerous groups claiming responsibility for attacks against Israeli and Western entities. These operations range from data exfiltration to denial-of-service attacks, indicating a coordinated effort to undermine adversary capabilities.

Threat Brief: March 2026 Escalation of Cyber Risk Related to Iran

Critics of Iran's cyber operations argue that these tactics not only escalate regional tensions but also pose significant risks to civilian infrastructure. The targeting of IP cameras, for instance, raises concerns about privacy and the potential for misuse of surveillance technologies in conflict zones.

Threat Brief: March 2026 Escalation of Cyber Risk Related to Iran

In light of the escalating cyber threats, cybersecurity experts recommend implementing robust defensive measures, including regular updates to security protocols and employee training on phishing and social engineering tactics. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has emphasized the importance of maintaining vigilance against potential cyber threats during this period of heightened conflict.

Threat Brief: March 2026 Escalation of Cyber Risk Related to Iran

While the increase in cyberattacks has been widely reported, there are discrepancies regarding the extent and impact of these operations. Some sources indicate that Iranian state-aligned cyber units may face operational challenges due to degraded internet connectivity within Iran, potentially limiting their ability to coordinate sophisticated attacks. However, the effectiveness of decentralized hacktivist groups remains a concern.

Threat Brief: March 2026 Escalation of Cyber Risk Related to IranInterplay between Iranian Targeting of IP Cameras and Physical Warfare in the Middle East

“Introduction As highlighted in the Cyber Security Report 2026, cyber operations have increasingly become an additional tool in interstate conflicts, used both to support military operations and to enable ongoing battle damage assessment (BDA).” — Check Point Research

Interplay between Iranian Targeting of IP Cameras and Physical Warfare in the Middle East

“We assess that the loss of connectivity and significant degradation of Iranian leadership and command structures will likely hinder the ability of state-aligned threat actors to coordinate and execute sophisticated cyberattacks in the near-term.” — Unit 42

Threat Brief: March 2026 Escalation of Cyber Risk Related to Iran

As the situation evolves, the interplay between cyber operations and traditional military engagements will continue to shape the dynamics of conflict in the Middle East.

Threat Brief: March 2026 Escalation of Cyber Risk Related to Iran