Tehran municipality

Summary

Israel compromised Tehran's street camera network and used the hijacked feeds to monitor movements of Iranian leaders, enabling the planning and execution of strikes that killed the supreme leader and injured the president. The compromised cameras provided real‑time video that, combined with AI analysis, revealed addresses, routes and security details of targets. Iranian officials had previously warned that the surveillance system was repeatedly breached, describing it as a national security threat. The operation demonstrated how surveillance infrastructure built for internal control can be turned into a targeting tool by adversaries.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

Tehran’s municipal surveillance network expanded after waves of protests, with tens of thousands of cameras installed across the capital to monitor public spaces and enforce rules such as the mandatory hijab. Beginning in 2021 the system was repeatedly compromised; an Iranian exile group leaked footage from Evin prison that year, and in 2022 another group claimed to have hacked over five thousand Tehran cameras, uploading gigabytes of video and internal data to a Telegram channel. During the June war with Iran Israeli forces used the compromised cameras to locate and strike a meeting of Iran’s Supreme National Security Council, an attack that injured President Masoud Pezeshkian according to Iranian lawmakers and an Israeli documentary. In September a senior Iranian parliamentarian told state media that all intersection cameras were under Israeli control and that any movement would be detected.

On February 28 Israel leveraged years of access to Tehran’s traffic cameras to track the daily movements of Ayatollah Ali Khamenei, having transferred the footage to servers in Israel for months. At least one camera provided a view of vehicles parked near the leadership compound, allowing analysts to derive addresses, routes and protective details through algorithmic processing of the video feed. The operation had been planned for months but was accelerated once intelligence confirmed that Khamenei and his top officials would be present at the compound that morning. Using the camera‑derived information Israeli forces located and killed the supreme leader, while the same surveillance data had previously supported the bombing of the SNSC meeting. Iranian officials described the camera breach as a national security threat, noting that the leadership’s movements were now visible to adversaries.

In response Iranian officials publicly warned that the surveillance system had been compromised by Israel, urging caution about the exposure of personal data. Israel’s National Cyber Directorate issued alerts to hundreds of camera owners who had been targeted by Iranian hacking attempts, advising them to change passwords and update software to reduce further intrusions. Check Point Research reported a spike in Iranian‑origin camera hacking activity since the start of the conflict, with noticeable increases in Israel and Gulf states such as Bahrain and the United Arab Emirates. Col. Amit Assa of Israel’s Shin Bet acknowledged that while the operation drew on multiple intelligence streams, the camera feeds provided essential visual confirmation for strike decisions. Israel’s Prime Minister’s Office did not comment on the incident when approached for clarification.

Sources

Sources available to members: 1 source.