Cyber Incident Victim: Tehran municipality
Date:
Feb 2026
Location:
Iran
Summary
Hackers linked to the ongoing conflict have intensified cyber operations against Iranian institutions, exploiting vulnerabilities in government and critical‑infrastructure networks to gather intelligence and disrupt services. The intrusions, described by analysts as a wake‑up call, have involved persistent probing and data‑exfiltration attempts that officials describe as a continual whack‑a‑mole effort to patch vulnerabilities. Despite ongoing patching efforts, the attacks persist, underscoring the difficulty of fully securing systems amid heightened regional hostilities.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
Iran installed tens of thousands of surveillance cameras in Tehran after waves of protests, most recently in January when nationwide demonstrations ended in a bloody crackdown that killed many thousands. The city’s cameras were repeatedly hacked starting in 2021, and in 2021 an Iranian exile group leaked footage of abuses at Evin prison. In 2022 another group claimed to have hacked over five thousand cameras around Tehran and dumped gigabytes of footage and internal data on a Telegram channel. During the June war with Iran, Israeli forces used Tehran’s cameras to track and bomb a meeting of Iran’s Supreme National Security Council, injuring President Masoud Pezeshkian. On February 28, Israel tracked down Ayatollah Ali Khamenei with the help of Tehran’s own street cameras, using at least one camera angled to monitor car parking near the leadership compound and transferring years of traffic‑camera data to servers in Israel for algorithmic analysis of addresses, routes and protective details.
The operation provided Israel with detailed information about Khamenei’s movements and his inner circle, contributing to the killing of the Iranian supreme leader. Iranian officials, including Mahmoud Nabavian, deputy chairman of the parliament’s national security committee, stated publicly that all intersection cameras were in Israeli hands and that any movement would be detected. The use of subway cameras for facial‑recognition enforcement of mandatory hijab rules highlighted how data gathered for internal control became a target for foreign exploitation. Gulf monarchies responded by banning residents from filming or livestreaming footage of Iranian strikes, and the United Arab Emirates arrested dozens of people for sharing conflict‑related video online.
Earlier this month, Israel’s National Cyber Directorate warned hundreds of camera owners that their devices were being targeted by Iran and urged the public to change passwords and update software to reduce the risk of further hijacking. Iranian senior politicians had previously warned that the surveillance network had been compromised by Israel, describing it as a national security threat. Check Point Research reported a spike in Iranian hacking attempts on cameras in Israel and Gulf states such as Bahrain and the United Arab Emirates since the start of the war. The broader context includes more than one billion security cameras worldwide, a number that has tripled over the past decade and continues to grow by hundreds of millions each year.