{
	"id": "f36f8ffb-0f67-43cb-8b2a-d3c9fc600bbf",
	"created_at": "2026-04-06T00:22:33.743632Z",
	"updated_at": "2026-04-10T03:31:48.810953Z",
	"deleted_at": null,
	"sha1_hash": "0f4fc231970b1c830ea90cee515edaf31fdd9f95",
	"title": "Report: Iran hacked Israeli cameras a year ago; defense officials knew, didn’t act",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 55236,
	"plain_text": "Report: Iran hacked Israeli cameras a year ago; defense officials\r\nknew, didn’t act\r\nBy By ToI Staff\r\nArchived: 2026-04-05 13:47:49 UTC\r\nIranian group controlled dozens of CCTV cameras for lengthy period, uploaded\r\nvideos of weapons factory and Jerusalem terror bombing, according to exposé set\r\nto air in full Tuesday\r\nBy Michael Horovitz\r\nYou will receive email alerts from this author. Manage alert preferences on your profile page\r\nYou will no longer receive email alerts from this author. Manage alert preferences on your profile page\r\n19 December 2022, 11:50 pm\r\nMichael Horovitz is a breaking news editor at The Times of Israel\r\nThe security establishment was aware for a year that an Iranian hacker group had seized control of dozens of\r\nIsraeli security cameras, but did nothing to stop it, as the group published several videos from across Israel,\r\nincluding footage of an arms facility last year and of a terror attack in Jerusalem last month, a report said Monday\r\nevening\r\nIn a preview of a full investigative report set to be aired on Tuesday, the Kan public broadcaster said officials did\r\nnot take action to secure the cameras, despite their knowledge of the activities of the group, known as Moses Staff.\r\nThe report did not cite sources during Monday’s snippet.\r\nThe group published footage a year ago on its Telegram channel of the surroundings of Israel’s Rafael defense\r\ncontractor factory in Haifa, as well as footage from cameras throughout Jerusalem and Tel Aviv.\r\nThe group also published footage last month of a terror bombing attack in Jerusalem which left two people dead,\r\nfrom a surveillance camera apparently used by a major Israeli security organization.\r\nAccording to Kan, hackers were able to pan, tilt and zoom cameras while they controlled them for a lengthy\r\nperiod. It was unclear if the cameras had since been proofed against the hackers.\r\nGet The Times of Israel's Daily Edition by email and never miss our top stories\r\nBy signing up, you agree to the terms\r\nSecurity officials told Kan that the videos uploaded by Moses Staff were recorded by civilian cameras that were\r\nnot connected to any security network.\r\nhttps://www.timesofisrael.com/report-iran-hacked-israeli-cameras-a-year-ago-defense-officials-knew-didnt-act/\r\nPage 1 of 2\n\nחשיפה: מצלמות הגוף הביטחוני שצילמו את הפיגוע ביציאה מירושלים לפני כחודש נפרצו על ידי האקרים\r\nאיראנים כבר לפני יותר משנה. גורמי ביטחון ידעו. התחקיר המלא של @1orenaharoni – מחר ב#-חדשותהערב\r\npic.twitter.com/fMhv3i8S72\r\n— חדשות כאן@) kann_news) December 19, 2022\r\nKan said the full report will explore hackers efforts to monitor senior Israeli officials and shine a light on those\r\nbehind Moses Staff.\r\nThe same hacker group claimed responsibility in June for a cyberattack that caused rocket sirens to go off in some\r\nareas of Jerusalem and the southern city of Eilat.\r\nMoses Staff in the past year said it leaked sensitive information about soldiers, which appeared to be publicly\r\navailable information on LinkedIn, and aerial imagery of Israel, which was obtained through a commercial site.\r\nIn another unsubstantiated assertion, the group claimed to have caused an army observation balloon to crash in the\r\nGaza Strip in June. The military said the balloon was not tethered correctly.\r\nEmanuel Fabian contributed to this report.\r\nIs our live war coverage important to you?\r\nAre you relying on The Times of Israel for accurate and timely coverage of the Iran war right now? If so, please\r\njoin The Times of Israel Community. For as little as $6/month, you will:\r\nSupport our independent journalists who are working around the clock under difficult conditions to cover\r\nthis conflict;\r\nRead ToI with a clear, ads-free experience on our site, apps and emails; and\r\nGain access to exclusive content shared only with the ToI Community, including weekly letters from\r\nfounding editor David Horovitz.\r\nJoin the Times of Israel Community Join our Community Already a member? Sign in to stop seeing this\r\nIf you’d like to comment, join\r\nThe Times of Israel Community.\r\nSource: https://www.timesofisrael.com/report-iran-hacked-israeli-cameras-a-year-ago-defense-officials-knew-didnt-act/\r\nhttps://www.timesofisrael.com/report-iran-hacked-israeli-cameras-a-year-ago-defense-officials-knew-didnt-act/\r\nPage 2 of 2",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://www.timesofisrael.com/report-iran-hacked-israeli-cameras-a-year-ago-defense-officials-knew-didnt-act/"
	],
	"report_names": [
		"report-iran-hacked-israeli-cameras-a-year-ago-defense-officials-knew-didnt-act"
	],
	"threat_actors": [
		{
			"id": "527e04ee-7f5f-49aa-8653-f893b43730bd",
			"created_at": "2022-10-25T16:07:24.512541Z",
			"updated_at": "2026-04-10T02:00:05.017592Z",
			"deleted_at": null,
			"main_name": "Moses Staff",
			"aliases": [
				"Abraham's Ax",
				"Cobalt Sapling",
				"DEV-0500",
				"G1009",
				"Marigold Sandstorm",
				"Vengeful Kitten",
				"White Dev 95"
			],
			"source_name": "ETDA:Moses Staff",
			"tools": [
				"DCSrv",
				"DCrSrv",
				"PyDCrypt",
				"StrifeWater",
				"StrifeWater RAT"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "bef06c82-0f51-44ba-8451-049cd4ad8a52",
			"created_at": "2023-01-06T13:46:39.325635Z",
			"updated_at": "2026-04-10T02:00:03.288171Z",
			"deleted_at": null,
			"main_name": "MosesStaff",
			"aliases": [
				"Moses Staff",
				"Marigold Sandstorm",
				"DEV-0500",
				"VENGEFUL KITTEN"
			],
			"source_name": "MISPGALAXY:MosesStaff",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "c4d0e4e1-5ad3-4455-8291-ce72a1e09e46",
			"created_at": "2022-10-27T08:27:13.055675Z",
			"updated_at": "2026-04-10T02:00:05.323068Z",
			"deleted_at": null,
			"main_name": "Moses Staff",
			"aliases": [
				"Moses Staff",
				"DEV-0500",
				"Marigold Sandstorm"
			],
			"source_name": "MITRE:Moses Staff",
			"tools": [
				"PyDCrypt",
				"PsExec",
				"DCSrv",
				"StrifeWater"
			],
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "6a5293c8-2a88-4a33-927a-4a0c946dc867",
			"created_at": "2025-08-07T02:03:24.778647Z",
			"updated_at": "2026-04-10T02:00:03.647413Z",
			"deleted_at": null,
			"main_name": "COBALT SAPLING",
			"aliases": [
				"Abraham's Ax ",
				"DEV-0500",
				"Marigold Sandstorm ",
				"Moses Staff ",
				"Vengeful Kitten "
			],
			"source_name": "Secureworks:COBALT SAPLING",
			"tools": [
				"DCSrv",
				"PyDcrypt",
				"StrifeWater RAT"
			],
			"source_id": "Secureworks",
			"reports": null
		}
	],
	"ts_created_at": 1775434953,
	"ts_updated_at": 1775791908,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/0f4fc231970b1c830ea90cee515edaf31fdd9f95.pdf",
		"text": "https://archive.orkl.eu/0f4fc231970b1c830ea90cee515edaf31fdd9f95.txt",
		"img": "https://archive.orkl.eu/0f4fc231970b1c830ea90cee515edaf31fdd9f95.jpg"
	}
}