Iran-Linked Hackers Mapped Ship AIS Data Days Before Real-World Missile Strike Attempt

This article from The Hacker News (based on Amazon’s threat intelligence report) is indeed one of the clearest public examples we’ve seen of cyber-enabled kinetic operations—where hacking isn’t just about stealing data or ransomware, but directly feeding real-time targeting intelligence into physical missile/ballistic strikes.Key takeaways that stand out:

1. Imperial Kitten (IRGC-linked) specifically hunted AIS (Automatic Identification System) transponders and live ship positions in late January 2024. Days later, the exact vessel they queried (identified in open sources as the Liberian-flagged KOI) was targeted by Houthi anti-ship ballistic missiles on February 1, 2024. The timing and specificity make coincidence extremely unlikely.
2. They didn’t stop at AIS. In at least one case they compromised onboard CCTV cameras, giving them eyes-on-target from the bridge or deck—essentially turning a commercial ship into an unwitting ISR (intelligence, surveillance, reconnaissance) platform for the Houthis/IRGC.
3. The MuddyWater (MOIS-linked) case in May–June 2025 is even more direct: Iranian actors built C2 infrastructure, pivoted to hijacked CCTV feeds in Jerusalem, and then—within weeks—Iran fired hundreds of ballistic missiles at Israel. Israeli cyber officials explicitly said the camera accesses were attempts at battle-damage assessment (BDA) in real time to improve follow-on salvos.

This is the new reality Amazon is highlighting: we’re moving from
“cyber attacks that occasionally spill into the physical world” (Stuxnet, Colonial Pipeline, etc.)
to
“kinetic campaigns that deliberately incorporate cyber reconnaissance as a core component.”Practical implications:

• Maritime AIS platforms, shipboard STARLINK terminals, and unhardened CCTV systems are now in the targeting loop for state actors.
• Commercial vessels are effectively soft ISR nodes; if you can quietly own their cameras or positioning systems, you’ve solved the over-the-horizon targeting problem for anti-ship missiles.
• The traditional “air gap” between IT/OT and physical security is meaningless when the adversary’s end goal is a missile, not ransomware.

This is why the U.S. Navy and commercial shipowners started disabling AIS in the Red Sea/Gulf of Aden in late 2023–early 2024, and why we’re now seeing classified briefings urging critical infrastructure (ports, energy, transportation) to treat IP-connected cameras and IoT devices as potential kinetic enablers, not just data-leak risks.In short: the merging of cyber and kinetic warfare isn’t coming—it’s already here, and the Red Sea and the June 2025 Iran–Israel exchange are two of the first openly documented instances.