Cyber Incident Victim: Tehran
Date:
Feb 2026
Location:
Iran
Summary
Iran’s extensivesurveillance camera network, installed to monitor dissent, was repeatedly compromised and used by Israel to locate and target the country’s supreme leader. Hacked feeds from Tehran’s streets provided real‑time video that AI systems analyzed to reveal the leader’s routines, routes, and protective details, enabling a strike on his leadership compound. The operation drew on months of intelligence gathering, with camera data confirming identities before the attack was launched. Israeli officials noted that the cameras served as a key verification tool for deciding to strike, while Iranian authorities had previously warned that the system posed a national security threat. The incident highlights how adversaries can weaponize civilian surveillance infrastructure, turning tools of internal control into instruments of targeted violence.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
Iran installed tens of thousands of surveillance cameras in Tehran after waves of protests, most recently in January when massive nationwide demonstrations ended in a bloody crackdown. The camera network was intended to monitor dissent and enforce rules such as mandatory hijab through facial recognition on subway cameras. Starting in 2021, Tehran’s cameras were repeatedly compromised; an exile group leaked footage from Evin prison that year. In 2022 another group claimed to have hacked over five thousand cameras around Tehran and posted surveillance data on a Telegram channel. Iranian officials publicly warned that the surveillance system had been compromised by Israel, describing it as a national security threat.
According to a person briefed on the operation, on February 28 Israel used the compromised Tehran street cameras to track the movements of Ayatollah Ali Khamenei, contributing to the killing of the country’s supreme leader. The hacked cameras fed video to servers in Israel, where algorithms extracted addresses, routes and protective details of individuals near the leadership compound. At least one camera angle allowed Israel to see where individuals parked their cars near the compound, informing the timing of the strike. The same source said the attack had been planned for months but was expedited once it was determined that Khamenei and his top officials would be at the compound that morning. In response, Israel’s National Cyber Directorate warned hundreds of camera owners about Iranian targeting and urged the public to change passwords and update software to stave off attacks. Iranian leaders, including a deputy chairman of the parliament’s national security committee, stated that all intersection cameras were effectively under Israeli control and that any movement would be detected.