Iran linked threat actors are increasingly using cyber operations to support and amplify real world physical attacks, a trend Amazon’s threat intelligence teams call cyber enabled kinetic targeting. This activity highlights the rapidly dissolving line between traditional kinetic warfare and cyber warfare.
Cyber Reconnaissance Enabling Maritime Attacks
Amazon experts provided two case studies demonstrating this fundamental shift in warfare.
In the first case, the Iran linked Advanced Persistent Threat (APT) group Imperial Kitten used cyber intrusions to support maritime attacks. The group initially breached a vessel’s Automatic Identification System (AIS) platform in late 2021. By 2022, the campaign expanded to include accessing onboard CCTV for real time intelligence.
The operation then shifted to targeted tracking. On January 27, 2024, the group searched for the AIS data on a specific ship. Just days later, on February 1, Houthi forces launched a missile strike on that exact vessel. This demonstrates how cyber reconnaissance can directly enable precise physical attacks on maritime targets.
Compromised Surveillance Systems
The second case involved the Iran linked APT group MuddyWater supporting kinetic attacks on Jerusalem.
On May 13, 2025, the group set up campaign servers. By June 17, they had gained access to a compromised server streaming live CCTV feeds from Jerusalem, granting them real time intelligence. On June 23, Iran launched missile strikes on the city. Israeli officials later confirmed that attackers exploited hacked cameras to adjust missile targeting during the strike itself. This case underscores how compromised surveillance systems act as real time sensors to directly support physical attacks.
Amazon’s research concludes that these Iranian linked groups use layered cyber infrastructure, including anonymizing VPNs and actor controlled servers, to infiltrate high value intelligence systems like maritime platforms and CCTV networks. The real time data streams from compromised sensors allow attackers to adjust targeting during military strikes. Amazon predicts that cyber enabled kinetic targeting will become increasingly common across multiple adversaries as nation state actors recognize the force multiplier effect of combining digital reconnaissance with physical attacks.
Found this article interesting? Follow us on X(Twitter) ,Threads and FaceBook to read more exclusive content we post.
