Iran-Linked Hackers Mapped Ship AIS Data Days Before Real-World Missile Strike Attempt

Threat actors with ties to Iran engaged in cyber reconnaissance to enable real-world attacks on maritime targets, according to Amazon’s threat intelligence team. The report highlights Imperial Kitten (also known as Tortoiseshell), assessed as affiliated with Iran’s IRGC, which conducted digital reconnaissance between December 2021 and January 2024, focusing on a ship’s AIS platform to access critical shipping infrastructure and later expanding to other maritime vessel platforms.

The group carried out targeted AIS data searches on 27 January 2024, and merely days afterwards the same vessel was targeted by an unsuccessful missile strike carried out by Iranian-backed Houthi militants, who have been linked to a string of Red Sea attacks. The findings also reference MuddyWater, another Iran-linked actor, which established cyber infrastructure in May 2025 and used a compromised server a month later to access live CCTV streams for real-time intelligence.

On 23 June 2025, around the time Iran launched missile attacks, the Israel National Cyber Directorate disclosed Iranians attempting to connect to cameras to understand missile impacts. These cases illustrate how cyber reconnaissance can support targeted physical attacks, illustrating the evolving overlap between cyber and kinetic warfare, according to Amazon.