Amazon Details Iran’s Cyber-Enabled Kinetic Attacks Linking Digital Spying to Physical Strikes

Amazon threat intelligence experts have documented two cases showing how Iran leveraged hacking to prepare for kinetic attacks, a practice they call cyber-enabled kinetic targeting. The first case involves Imperial Kitten and Tortoiseshell, believed to operate for Iran’s IRGC since at least 2017, with a timeline spanning more than two years from digital spying to a physical strike.

According to Amazon, Imperial Kitten compromised a ship’s Automatic Identification System platform in December 2021, then in August 2022 hacked additional maritime vessel platforms and even accessed CCTV cameras to obtain real-time visual intelligence. In January 2024 the group searched AIS location data for a ship, and on 1 February 2024 that vessel was targeted in a missile strike by Iran’s allied Houthi forces, an event the company notes was correlated with cyber reconnaissance.

The second, more recent case centres on MuddyWater, observed provisioning a server for cyber network operations in mid‑May 2025 and, less than a month later, leveraging the same infrastructure to access live CCTV streams from Jerusalem for potential targets in preparation for a 23 June missile attack. Researchers say cyber-enabled kinetic targeting marks an evolution in warfare, where cyber reconnaissance can directly enable physical attacks.