Cyber-enabled kinetic targeting: Iran-linked actor uses cyber operations to support physical attacks

Cyber-enabled kinetic targeting is the term used to describe how cyber operations are increasingly planned to support real-world military actions, a trend highlighted by Amazon threat intel teams. Iran-linked threat actors run campaigns that blend cyber intrusions with physical objectives, as shown in two case studies.

In the first, Imperial Kitten breached a vessel’s AIS platform in December 2021 and by August 2022 expanded to access onboard CCTV for real-time intelligence; in January 27, 2024 they searched AIS data on a specific ship, with a February 1, 2024 missile strike on that vessel following shortly after.

A second case involved MuddyWater, which set up campaign servers on May 13, 2025 and by June 17 accessed a compromised server streaming live CCTV from Jerusalem, with a missile strike on the city on June 23, 2025 and attackers using hacked cameras to adjust targeting, according to the report. The Record is cited regarding Israeli officials urging citizens to disconnect internet-connected security cameras to prevent such real-time intelligence gathering.