Threat actors intensify targeting of IP cameras across the Middle East amid ongoing conflict

Check Point Research says it observed a sharp rise in attempts to exploit internet-connected Hikvision and Dahua IP cameras across Israel, Qatar, Bahrain, Kuwait, the UAE, Cyprus, and Lebanon starting February 28, 2026. The activity came from infrastructure Check Point attributes to multiple Iran-nexus threat actors, and it focused only on these two camera vendors in the telemetry Check Point analyzed.

Check Point also says it saw earlier, more targeted waves on January 14–15 against cameras in Israel and Qatar, and it links the timing to heightened regional tension and Iran’s temporary airspace closure during that period.

The practical risk is straightforward. If your cameras or NVRs sit on the public internet and still run old firmware, attackers can attempt authentication bypass, command injection, or remote code execution using known CVEs. Check Point says patches exist for every vulnerability it listed, so exposure and patching discipline will decide who gets hit next.

What researchers observed

Check Point says the attacking infrastructure combined commercial VPN exit nodes and VPS hosts. It specifically names Mullvad, ProtonVPN, Surfshark, and NordVPN as VPN providers seen in the infrastructure used for scanning.

Check Point’s findings also connect camera targeting to operational support and battle damage assessment concepts. It says monitoring camera-targeting from attributed infrastructure may serve as an early indicator of potential follow-on kinetic activity in some cases.

Targeted countries and activity windows

Vulnerabilities being scanned and exploited

Check Point mapped the activity to five known vulnerabilities spanning Hikvision and Dahua products.

Why Hikvision and Dahua deployments face outsized risk

These brands appear widely deployed in public spaces and commercial sites, which makes them attractive for real-time visual intelligence. Check Point says it did not see interaction attempts against other camera vendors from the same tracked infrastructure, which suggests deliberate targeting rather than random scanning.

Independent coverage adds context. The Register reports Check Point tracked “hundreds” of exploit attempts tied to these CVEs since hostilities began on February 28, based on an interview with a Check Point threat intelligence manager.

What organizations should do now

• Remove direct WAN exposure for cameras and NVRs. Put them behind a VPN or a zero-trust access gateway and block port forwards.
• Change default credentials and enforce unique passwords per device.
• Patch firmware and management platforms. Check Point says updates are available for all listed CVEs and it recommends replacing end-of-life devices that no longer receive fixes.
• Segment camera networks. Put cameras on a dedicated VLAN and block lateral access to corporate or OT networks. Limit outbound traffic to only required endpoints.
• Monitor for compromise signals like repeated login failures, unexpected remote logins, or unusual outbound connections initiated by camera systems.

Fast hardening checklist

FAQ