Iranian Cyber Ops Maintain US Network Footholds, Target Cameras for Regional Surveillance

Iran’s cyber operations took a sharp turn in early 2026, with state-linked threat actors quietly embedding themselves inside US and Canadian networks while also targeting internet-connected surveillance cameras across the Middle East for battlefield intelligence.

The Iranian APT group MuddyWater, tied to Iran’s Ministry of Intelligence and Security (MOIS), maintained unauthorized access to multiple American organizations since February 2026.

Targeted sectors include banking, aviation, defense supply chains, and non-profit organizations.​

These intrusions came to light through reporting by Symantec and Carbon Black, which identified suspicious MuddyWater activity across US and Canadian networks.

Investigators found that the group deployed undocumented malware to establish persistent footholds inside victim environments. The campaign appears focused on long-term intelligence collection rather than immediate disruption — a hallmark of state-sponsored espionage.​

PolySwarm analysts identified multiple malware families connected to MuddyWater’s targeting of US entities, including Dindoor, Fakeset, Stagecomp, and Darkcomp.

The Dindoor backdoor was deployed inside a US software company’s network serving defense and aerospace clients, using the Deno runtime for JavaScript and TypeScript to execute commands and maintain access.

Fakeset, a Python-based backdoor, was found on the networks of a US airport and a non-profit organization. Both tools were designed to stay hidden while preserving long-term footholds.​

Beyond network infiltration, Iran-linked infrastructure launched a wave of scanning activity against internet-connected surveillance cameras starting February 28, 2026.

Check Point Research observed this surge in exploit attempts, which targeted Hikvision and Dahua cameras deployed across commercial, government, and municipal environments in the region.

The scanning activity hit Israel, Qatar, Bahrain, Kuwait, the United Arab Emirates, Lebanon, and Cyprus. The timing matched the start of major regional hostilities, making these camera intrusions a key part of Iran’s battlefield intelligence strategy.​

Iran-aligned hacktivist group Handala also claimed a destructive cyberattack against Stryker, a Fortune 500 medical technology firm.

Attackers reportedly exfiltrated around 50 terabytes of data before deploying wiper malware across the company’s global network.

Corporate laptops and mobile devices enrolled in enterprise management systems were remotely wiped, forcing some locations to revert to manual processes.

This attack underlines the expanding role of Iran-aligned proxy groups across different sectors of its broader cyber operations.​

Surveillance Camera Exploitation: A Low-Cost Intelligence Platform

The exploitation of internet-connected surveillance cameras is not simply opportunistic — it is a calculated tactic that turns everyday security infrastructure into a real-time battlefield observation platform.

By compromising Hikvision and Dahua devices through known vulnerabilities, Iranian operators can monitor locations, track emergency response movements, and assess damage after missile or drone strikes.

CVE-2017-7921, an improper authentication flaw in Hikvision firmware, and CVE-2021-33044, an authentication bypass in Dahua devices, were key vulnerabilities exploited in this campaign.​

This same tactic was observed during the June 2025 Iran-Israel conflict, when compromised cameras were reportedly used to observe the aftermath of strikes against Israeli targets.

Repeating this playbook in early 2026 shows that Iranian actors treat IP camera exploitation as a reliable, low-cost intelligence tool.

These devices often run outdated firmware and fall outside standard enterprise security monitoring, making them easy targets with high operational value.​

Organizations running Hikvision or Dahua cameras should apply all available firmware patches immediately, especially those addressing CVE-2017-7921, CVE-2021-36260, CVE-2023-6895, CVE-2025-34067, and CVE-2021-33044.

Camera systems should be isolated from core enterprise networks through proper segmentation to block lateral movement in the event of compromise.

Unnecessary remote access features should be disabled, and strong authentication should be enforced across all connected devices. Security teams should monitor for unusual outbound traffic from camera systems, as this can signal active exploitation.​

For organizations in sectors targeted by MuddyWater — banking, aviation, defense, and healthcare — detecting tools like Dindoor and Fakeset requires watching for unusual Deno runtime activity, unexpected Python processes, and outbound Rclone traffic that could indicate data exfiltration.

Malware samples were signed with digital certificates previously linked to MuddyWater, so certificate-based detection and traffic inspection should be part of any defense strategy.

Incident response teams should treat these footholds as high-priority risks given the current geopolitical climate.​

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.