Cyber Incident Victim: Iran
Date:
Feb 2026
Location:
Iran
Summary
Iran's surveillance camera network, intended to monitor domestic dissent, was infiltrated by Israeli operatives who accessed the feeds and used artificial intelligence to identify the movements of the Supreme Leader and other officials, facilitating precise targeting. The compromised cameras also provided intelligence for strikes on meetings of Iran's Supreme National Security Council, resulting in injuries to the president. The operation highlighted how poorly secured cameras worldwide can be turned into weapons, prompting concern among governments about the security of their own surveillance infrastructure.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 0 motives | 2 techniques |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
Iran constructed a extensive surveillance camera network in Tehran to monitor and suppress domestic dissent, installing tens of thousands of cameras after waves of protests, most recently in January 2026 when nationwide demonstrations ended in a bloody crackdown. Beginning in 2021, the city’s cameras were repeatedly compromised, with an Iranian exile group leaking footage of abuses at Evin prison that year. In 2022 another group claimed to have hacked over five thousand cameras around Tehran and dumped gigabytes of surveillance data on a Telegram channel. Iranian officials publicly warned that the surveillance system had been compromised by Israel, describing it as a national security threat. These early intrusions demonstrated the vulnerability of Iran’s camera infrastructure to external actors. During a twelve‑day conflict in the summer of 2025, Israeli forces used the hacked Tehran cameras to locate and strike a meeting of Iran’s Supreme National Security Council, injuring President Masoud Pezeshkian according to Iranian lawmakers and an Israeli documentary. On February 28, 2026, Israel leveraged the same compromised camera network to track Supreme Leader Ayatollah Ali Khamenei, feeding footage from Tehran’s street cameras into Israeli intelligence systems. The operation had been planned for months and was accelerated once analysts confirmed that Khamenei and his top officials would be present at the leadership compound that morning. Almost all traffic cameras in Tehran had been hacked, with their video streams transferred to servers in Israel. At least one camera provided a view that allowed Israel to monitor daily movements, such as where individuals parked their cars near the compound. Automated algorithms processed the feeds to extract addresses, routes and protective details, enabling real‑time targeting decisions.
In response to the exposure, Israel’s National Cyber Directorate warned hundreds of camera owners that they had been targeted by Iran and urged the public to change passwords and update software to reduce further attacks. Gulf monarchies, concerned that footage of Iranian strikes could be exploited, barred residents from filming or livestreaming such events, and the United Arab Emirates arrested dozens of people for sharing conflict videos online. Check Point Research reported a spike in Iranian hacking attempts on cameras since the start of the war, with noticeable surges in Israel, Bahrain and the United Arab Emirates. Analysts noted that more than one billion security cameras are installed worldwide, a figure that has tripled over the past decade. Officials such as Col. Amit Assa of Israel’s Shin Bet emphasized that cameras provided essential visual confirmation for strike decisions, while Ali Vaez of the International Crisis Group described the increase in camera hacking since the war as a wake‑up call, characterizing the ongoing effort to secure devices as a whack‑a‑mole.