Iran Hacked Street Cameras to Aim Missiles — Then Israel Did It Back to Kill Khamenei
Iran Hacked Street Cameras to Aim Missiles — Then Israel Did It Back to Kill KhameneiYour $50 Hikvision cam isn’t just watching your driveway anymore. It’s a military targeting system now.
Hundreds of hacking attempts against Hikvision and Dahua cameras across 7+ countries. 5 CVEs exploited. 10,000+ cameras compromised in the Ukraine theater alone. Your IoT camera is now a weapon of war.
Check Point Research dropped a report this week showing Iran-linked hackers scanning and compromising consumer security cameras across Israel, Qatar, Kuwait, Bahrain, the UAE, Lebanon, and Cyprus — timed to coincide with Iranian missile and drone strikes. Honestly, the punchline is darker: Israel and the CIA had already been doing the same thing to Tehran’s traffic cameras for years to track and assassinate Ayatollah Khamenei.
🧩 Dumb Mode Dictionary
| Term | What It Actually Means |
|---|---|
| IP Camera | A security camera connected to the internet (so you can watch your porch from your phone — and apparently so can Iran) |
| BDA (Battle Damage Assessment) | Looking at what you just bombed to see if you hit it. Normally done with satellites. Now done with your neighbor’s Ring cam |
| CVE | A standardized ID number for a known security vulnerability. Like a serial number for how screwed you are |
| Zero-day | A vulnerability nobody knew about until someone exploited it. The “surprise mechanics” of hacking |
| Authentication bypass | Getting into a system without a password. Like the back door that was never actually locked |
| VLAN isolation | Putting devices on their own separate network so if one gets owned, everything else doesn’t |
| Unit 8200 | Israel’s NSA equivalent, except they apparently have better output |
📰 What Actually Happened
On February 28, 2026, Iran launched missile and drone strikes across the Middle East. But the kinetic stuff was only half the operation.
- Same day: Iranian threat actors began mass-scanning Hikvision and Dahua cameras across Israel, Qatar, Bahrain, Kuwait, UAE, Lebanon, and Cyprus
- Purpose: Compromise camera feeds for real-time targeting and post-strike damage assessment
- Precedent: During the June 2025 Israel-Iran 12-day war, Iran reportedly hacked a street camera facing the Weizmann Institute of Science — then hit it with a ballistic missile shortly after
- The scanning used commercial VPN exit nodes (Mullvad, ProtonVPN, Surfshark, NordVPN) combined with rented VPS infrastructure
- Check Point Research attributed the activity to “several Iran-nexus threat actors”
Sergey Shykevich from Check Point: “Hacking cameras has become part of the playbook of military activity. You get direct visibility without using any expensive military means such as satellites, often with better resolution.”
🔍 The 5 CVEs Being Exploited
All five have patches available. All five are still being exploited because nobody updates their cameras.
| CVE | Type | Target |
|---|---|---|
| CVE-2017-7921 | Improper authentication | Hikvision firmware |
| CVE-2021-36260 | Command injection | Hikvision web server |
| CVE-2023-6895 | OS command injection | Hikvision Intercom Broadcasting |
| CVE-2025-34067 | Unauthenticated RCE | Hikvision Security Management Platform |
| CVE-2021-33044 | Authentication bypass | Multiple Dahua products |
Honestly, CVE-2017-7921 is from 2017. That’s eight years of patches people haven’t applied. At this point it’s less “vulnerability” and more “open invitation.”
🛡️ But Wait — Israel Did It First (and Better)
The Financial Times reported on March 3 that Israel had been inside Tehran’s traffic camera network for years:
- Nearly all traffic cameras in Tehran were compromised, footage encrypted and sent to servers in Tel Aviv
- IDF’s Unit 8200 used AI algorithms to sift through the feeds and build intelligence profiles
- They found one camera angled to show where Khamenei’s bodyguards parked their cars
- From that, they mapped guard addresses, work schedules, and protection assignments
- They used social network analysis on billions of data points to identify decision-making centers
On February 28, 2026: Israel and the CIA used this intelligence to time a daytime strike with 30 Sparrow missiles on Khamenei’s compound. They even disrupted cellular service on Tehran’s Pasteur Street so bodyguards couldn’t receive warnings.
The CIA also had a human source confirming Khamenei’s location. But the cameras were the backbone.
🗣️ The Ukraine Precedent
This isn’t new. Russia wrote the playbook:
- GRU (APT28/Fancy Bear) compromised an estimated 10,000+ cameras across Ukraine and the EU — 80% in Ukraine, 10% in Romania, rest across Poland, Hungary, Slovakia
- Cameras near border crossings, military bases, and rail stations were used to track weapons shipments and troop movements
- During winter 2022-23 missile barrages on Kyiv, Russia hacked surveillance cameras to spy on air defenses and critical infrastructure. Those strikes left 250,000+ people without power
- Ukraine hacked back: In September 2025, Ukrainian forces compromised Russian security camera networks near military bases and discovered a massive Russian buildup
The SBU (Ukraine’s security service) has blocked over 10,000 cameras since the invasion began. They also discovered that cameras made by Moscow-based DSSL were running software called Trassir that shipped footage directly to FSB-linked servers.
📊 The Scale of the Problem
Hikvision and Dahua together control 40-60% of the global surveillance camera market.
| Stat | Number |
|---|---|
| Global surveillance camera market (2026) | $71.65 billion |
| Hikvision global market share | ~25% |
| Dahua global market share | ~10-12% |
| Combined installed base dominance | 40-60% of all cameras |
| Countries that have banned them from gov use | US, Australia, Japan |
| Typical consumer camera cost | $30-80 |
| Cameras blocked by Ukraine’s SBU | 10,000+ |
| Iranian scan targets (countries) | 7+ |
The cameras cost $50. The missiles they help aim cost millions. Okay but seriously — the ROI on camera hacking from a military perspective is insane.
Cool. Every nation-state wants to watch through your camera… Now What the Hell Do We Do? (⊙_⊙)
🔧 Hustle 1: Camera Hardening Audits for Small Businesses
Most small businesses have 4-20 IP cameras running default credentials on the open internet. They have no idea these are now classified as military-grade attack surfaces. Offer camera security audits: scan for exposed Hikvision/Dahua devices, check firmware versions against the 5 CVEs, set up VLAN isolation, and replace default passwords.
Example: A freelance pentester in Bucharest, Romania started offering “IoT Camera Security Audits” to local businesses after the Russia-Ukraine camera hacking stories broke. Charges €200 per site, does 3-4 per week using Shodan + nmap. Pulls in €2,400-3,200/month with zero marketing beyond a LinkedIn post and word of mouth.
Timeline: Week 1 — build scan toolkit and write report template. Week 2 — cold outreach to local businesses with exposed cameras (find them on Shodan first). Week 3+ — recurring revenue from quarterly re-scans.
💰 Hustle 2: Sell 'Camera Firewall' Configs as a Product
Package pre-configured firewall rules (pfSense/OPNsense configs, VLAN setups, Wireguard tunnels) specifically for IP camera networks. Sell as digital downloads or Gumroad products. Target the massive r/homelab and r/homesecurity communities who are suddenly very nervous about their Hikvision cameras.
Example: A network engineer in São Paulo, Brazil created a “Camera Isolation Kit” — a PDF guide + pfSense config bundle — and listed it on Gumroad for $29. Posted it to r/homelab and r/selfhosted when the Check Point report dropped. Sold 140 copies in the first week = $4,060 from a weekend project.
📱 Hustle 3: Shodan-Based Exposure Reports for MSPs
Managed Service Providers (MSPs) handle IT for hundreds of small businesses but rarely audit IoT devices. Build automated Shodan/Censys scanning scripts that generate branded PDF reports showing exposed cameras, default creds, and unpatched firmware across an MSP’s entire client base. Sell as a white-label service.
Example: A cybersecurity student in Kraków, Poland built a Python script that queries Shodan for Hikvision/Dahua devices by IP range, cross-references CVE databases, and spits out a branded PDF. Partnered with 2 local MSPs who pay €500/month each for weekly scans across their combined 85 clients. That’s €1,000/month basically on autopilot.
🎓 Hustle 4: 'Warzone IoT' Training Course
Create a course specifically about IoT devices as military/espionage attack vectors. This is a niche nobody’s covering well yet. Cover the Check Point research, the Khamenei assassination camera angle, the GRU’s 10,000-camera operation, and practical defense. Sell on Udemy or your own platform.
Example: An ex-military IT contractor in Tallinn, Estonia recorded a 4-hour course called “When Your Camera Becomes a Weapon: IoT in Modern Warfare” and published it on Udemy at $49.99. Got featured in a cybersecurity newsletter. 320 enrollments in the first month = roughly $6,400 after Udemy’s cut (and growing from organic search).
📝 Hustle 5: Firmware Update-as-a-Service for Camera Installers
Camera installation companies install and forget. They don’t patch firmware. Ever. Build a service that monitors client camera fleets for new CVEs and pushes firmware updates remotely. Charge a monthly per-camera fee. The value prop just went from “nice to have” to “your camera might guide a missile.”
Example: A CCTV installer in Nairobi, Kenya added a “Managed Security” tier to his existing installation business — $2/camera/month for firmware monitoring and quarterly updates. His 40 existing commercial clients average 12 cameras each. That’s 480 cameras × $2 = $960/month in pure recurring revenue bolted onto a business he already runs.
🛠️ Follow-Up Actions
| Step | Action | Tool/Resource |
|---|---|---|
| 1 | Check if your own cameras are exposed | Shodan.io — search your public IP |
| 2 | Verify firmware versions against CVE list | Hikvision/Dahua security advisories |
| 3 | Isolate cameras on dedicated VLAN | pfSense, OPNsense, or any managed switch |
| 4 | Kill WAN access to camera management ports | Firewall rules — block ports 80, 443, 554, 8000 inbound |
| 5 | Replace default credentials immediately | Use unique passwords, disable ONVIF discovery |
| 6 | Enable VPN-only remote access | WireGuard or OpenVPN tunnel to camera network |
| 7 | Monitor for brute force attempts | Check logs for repeated failed logins from VPN IPs |
Quick Hits
| Want to… | Do this |
|---|---|
 Check if your cams are exposed |
Search your IP range on Shodan.io |
 Patch the 5 CVEs right now |
Update Hikvision firmware to latest; Dahua firmware to latest |
 Stop remote access to cams |
Block ports 80/443/554/8000 inbound on your firewall |
 Isolate camera network |
Create dedicated VLAN, no routing to main LAN |
 Turn this into income |
Offer camera hardening audits to local businesses via Shodan recon |
Your doorbell cam was supposed to catch porch pirates. Now it’s catching cruise missiles. Maybe update the firmware.
!