Iran

Summary

Israel hijacked Iran's vast domestic surveillance camera network—originally built to monitor dissent and enforce controls like mandatory hijab compliance—and weaponized it to track and kill Supreme Leader Ayatollah Ali Khamenei, demonstrating how poorly secured cameras worldwide can be exploited by adversaries. The operation exploited years of prior compromises dating back to 2021, with hacked traffic camera footage transferred to Israeli servers and analyzed using AI algorithms to identify targets' locations, daily routines, and security details. This incident exposed the double-edged nature of authoritarian surveillance infrastructure and triggered alarm across the Middle East, with Gulf states tightening controls on camera use and public filming, while Israel simultaneously warned of retaliatory Iranian cyber intrusions targeting cameras in its territory and allied nations.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On February 28, 2026, Israel tracked and killed Iranian Supreme Leader Ayatollah Ali Khamenei with the assistance of Tehran's own street camera network, a surveillance system Iran had built over several years to monitor dissent and enforce domestic control. According to a person briefed on the operation, almost all traffic cameras in Tehran had been hacked for years, with the footage transferred to servers in Israel. At least one camera was positioned at an angle that allowed Israeli intelligence to track daily movements of people, including where they parked their vehicles near Iran's leadership compound. Algorithms processed the footage to extract information such as individuals' addresses, the routes they took to work, and details about their security details. The attack had been planned for months but was expedited once it was determined that Khamenei and his top officials would be present at the leadership compound that morning. AI capabilities allowed Israeli forces to sift through vast amounts of surveillance footage in real time, identifying targets far more quickly than traditional human analysis would have permitted.

The compromise of Tehran's camera network was not a sudden development. In 2021, an Iranian exile group leaked footage of abuses at Tehran's Evin prison after hacking cameras at the facility. In 2022, another group claimed responsibility for hacking over 5,000 cameras around Tehran, dumping gigabytes of surveillance footage and internal data onto a Telegram channel. During a 12-day war the previous summer, Israel had already used Tehran's cameras to track and bomb the location of a meeting of Iran's Supreme National Security Council, an operation that injured Iranian President Masoud Pezeshkian. Following that incident, Mahmoud Nabavian, deputy chairman of the Iranian parliament's national security committee, told Iranian media in September that "all the cameras at our intersections are in the hands of Israel" and warned that "everything on the internet is in their hands." The cameras had been installed in their tens of thousands across the capital, particularly in response to waves of protests, most recently in January 2026, when massive nationwide demonstrations ended in a bloody crackdown that killed many thousands of Iranians. Despite repeated public warnings about the vulnerabilities, Iran continued to rely on the compromised infrastructure.

The scale of camera insecurity extends far beyond Iran. Security engineer Paul Marrapese discovered in 2019 that millions of cameras worldwide could be easily hacked from a home computer. A scan of unprotected camera feeds conducted in 2026 turned up nearly three million hits in almost every country, including nearly 2,000 cameras in Iran alone. Many of these devices are installed with minimal security, often by unsophisticated users who fail to set passwords or apply security patches, making them accessible with generic credentials like "1234." Even government surveillance systems on networks sealed off from the internet remain vulnerable to insider threats. Analysts estimate more than one billion security cameras are installed worldwide, with hundreds of millions more added each year. The conflict has spurred regional responses, with Gulf monarchies including the UAE arresting dozens of residents for sharing video footage of Iranian strikes online, citing concerns that such content could be exploited by adversaries for targeting purposes.

Cyber activity has been bidirectional. Check Point Research reported that Iranian hacking attacks on cameras spiked since the beginning of the war, with surges of activity targeting Israel and Gulf countries such as Bahrain and the United Arab Emirates. These hacks could enable Iran to monitor targets and assess damage after missile strikes. Earlier in March 2026, Israel's National Cyber Directorate disclosed that it had warned hundreds of camera owners targeted by Iran and urged the public to change passwords and update software to prevent further intrusions. Eyal Hulata, Israel's former national security adviser, confirmed that Israel faces constant cyberattacks from Iran but has so far been able to defend against them, noting a state of "high alert on all cyber fronts." Previous incidents had already established the pattern of weaponizing hacked cameras: in 2023, Hamas hacked surveillance cameras in southern Israel ahead of its October 7 attack to monitor army patrols, and Russia was reported to have hijacked cameras near missile targets in Ukraine that same year, continuing through 2024 with hacks in Kyiv and at border crossings.

Sources

Sources available to members: 2 sources.