Amazon security boss: Hostile countries use cyber targeting for physical military strikes
(2025/11/19)
- Reference: 1763576764
- News link: https://www.theregister.co.uk/2025/11/19/amazon_cso_warfare_cyber_kinetic/
- Source link:
interview Warfare has become a joint cyber-kinetic endeavor, with nations using cyber operations to scope out targets before launching missiles. And private companies, including shipping, transportation, and electronics manufacturers, are getting caught in the crossfire, according to Amazon.
This represents a "new operational model that's neither traditional cyber attack nor conventional warfare," Amazon Chief Security Officer Steve Schmidt told The Register . "The targeting data collected through cyber means flows directly into kinetic decision making."
It also requires companies to take a different approach to security and risk management.
[1]
"Organizations that historically didn't consider themselves targets for nation-state actors - like a shipping company - may now be targeted simply because they have access to valuable intelligence, like surveillance cameras or industrial control systems or location data," Schmidt said.
[2]
[3]
"Moreover, physical and digital security can no longer be treated as separate domains with separate teams and approaches who don't share with each other," he continued. "Organizations need to consider how their systems might be leveraged, not just for direct exploitation, but as intelligence tools and broader operations."
Digital recon to physical attacks
Case in point: Iran's government-backed cyber threat groups, Imperial Kitten and MuddyWater, used digital reconnaissance to prepare for physical attacks.
In a [4]blog post published Wednesday and shared ahead of publication with The Register , Amazon Chief Information Security Officer CJ Moses details two examples of how cyber operations preceded military strikes. Amazon Threat Intelligence spotted both of these campaigns using a combination of intel from its MadPot honeypot systems, customer data (provided on an opt-in basis), and threat-sharing between government agencies and industry partners.
[5]Imperial Kitten (aka UNC1549, Smoke Sandstorm, and APT35), which operates on behalf of Iran's Islamic Revolutionary Guard Corps (IRGC), compromised a maritime vessel's Automatic Identification System (AIS) platform in December 2021, giving it access to critical shipping infrastructure.
[6]
Amazon says it worked with the affected organization to remediate the threat.
Then, in August 2022, Imperial Kitten expanded its targeting to additional ships, and in one instance, broke into CCTV cameras aboard the vessel, providing real-time visual intelligence.
In January 2024, the IRGC's cyber arm began conducting targeted searches for AIS location data for a specific shipping vessel, and on February 1, 2024, US Central Command reported a missile strike by Houthi forces against that ship. "While the missile strike was ultimately ineffective, the correlation between the cyber reconnaissance and kinetic strike is unmistakable," Moses wrote.
[7]
In a more recent example: Amazon tracked [8]MuddyWater (aka Seedworm, APT34, OilRig, and TA450), which is linked to Iran's Ministry of Intelligence and Security (MOIS), provisioning a server for a cyber campaign on May 13. On June 17, they used this infrastructure to access another compromised server containing live CCTV streams from Jerusalem, allowing the crew to surveil the city for potential targets.
And on June 23, "Iran launches widespread missile attacks against Jerusalem. On the same day, Israeli authorities report that Iranian forces were exploiting compromised security cameras to gather real-time intelligence and adjust missile targeting."
It's not just Iran combining cyber and physical warfare. There have also been reports of [9]Russia hacking into surveillance cameras to coordinate its attack on Kyiv. "We know that Iran and Russia both have a very tight intelligence-sharing relationship," Schmidt told The Register.
Then, there's China. "We certainly have seen the [10]Chinese continue down the path that they've been on, which is both [11]pre-positioning for access , but also intentionally combining intelligence gathering and physical world attacks," he added. "A public example of that was when they compromised the [12]water and electrical systems on Guam ."
[13]Amazon CISO: Iranian hacking crews 'on high alert' since Israel attack
[14]Despite Russia warnings, Western critical infrastructure remains unprepared
[15]Why is China deep in US networks? 'They're preparing for war,' HR McMaster tells lawmakers
[16]Chinese spy crew appears to be preparing for conflict by backdooring 75+ critical orgs
Network defenders working to combat these types of cyber-enabled kinetic attacks must expand their threat models and improve intelligence sharing, according to Amazon.
"The first thing organizations need to do is make an intentional decision to look at the two domains together, to understand how their physical world and their logical world are connected," Schmidt said. "For example: How are the lights controlled in my corporate headquarters? If the building is at all modern, they're probably controlled via some internet connected system. How is that system protected? Who's watching it? Who's responsible?"
The next step, he said, is to understand the supply chain components of each part of the business: "Where are they physically located? How are they shipped in and out of that location? Where are those shipping documents stored? Who has access to the physical containers along the way? Start down the process of just unraveling all the very complex inter-relations that we have between the physical world and the logical world."
Unfortunately, there's no easy button for this. It's time consuming, tedious work. But, according to Schmidt, it's a critical risk-management practice.
"The physical world and the logical world are interrelated," he said. "If organizations don't view the threat holistically across both of those domains, they will be missing opportunities." ®
Get our [17]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cso&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aR5MCeR6HEa2fS2Yd-e8EgAAABI&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cso&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aR5MCeR6HEa2fS2Yd-e8EgAAABI&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cso&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aR5MCeR6HEa2fS2Yd-e8EgAAABI&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[4] https://aws.amazon.com/blogs/security/new-amazon-threat-intelligence-findings-nation-state-actors-bridging-cyber-and-kinetic-warfare/
[5] https://www.theregister.com/2023/11/10/iran_israel_hamas/
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cso&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aR5MCeR6HEa2fS2Yd-e8EgAAABI&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cso&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aR5MCeR6HEa2fS2Yd-e8EgAAABI&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[8] https://www.theregister.com/2025/10/24/iran_muddywater_campaign/
[9] https://www.yahoo.com/news/russia-hacked-kyiv-surveillance-cameras-132627907.html
[10] https://www.theregister.com/2025/06/09/china_malware_flip_switch_sentinelone/
[11] https://www.theregister.com/2024/02/07/us_chinas_volt_typhoon_attacks/
[12] https://www.theregister.com/2024/12/31/china_cyber_intrusions_2024/
[13] https://www.theregister.com/2025/06/18/amazon_ciso_agentic_acceleration/
[14] https://www.theregister.com/2024/09/18/russia_west_critical_infrastructure/
[15] https://www.theregister.com/2025/05/29/china_preparing_war_mcmaster/
[16] https://www.theregister.com/2025/06/09/china_malware_flip_switch_sentinelone/
[17] https://whitepapers.theregister.com/
This represents a "new operational model that's neither traditional cyber attack nor conventional warfare," Amazon Chief Security Officer Steve Schmidt told The Register . "The targeting data collected through cyber means flows directly into kinetic decision making."
It also requires companies to take a different approach to security and risk management.
[1]
"Organizations that historically didn't consider themselves targets for nation-state actors - like a shipping company - may now be targeted simply because they have access to valuable intelligence, like surveillance cameras or industrial control systems or location data," Schmidt said.
[2]
[3]
"Moreover, physical and digital security can no longer be treated as separate domains with separate teams and approaches who don't share with each other," he continued. "Organizations need to consider how their systems might be leveraged, not just for direct exploitation, but as intelligence tools and broader operations."
Digital recon to physical attacks
Case in point: Iran's government-backed cyber threat groups, Imperial Kitten and MuddyWater, used digital reconnaissance to prepare for physical attacks.
In a [4]blog post published Wednesday and shared ahead of publication with The Register , Amazon Chief Information Security Officer CJ Moses details two examples of how cyber operations preceded military strikes. Amazon Threat Intelligence spotted both of these campaigns using a combination of intel from its MadPot honeypot systems, customer data (provided on an opt-in basis), and threat-sharing between government agencies and industry partners.
[5]Imperial Kitten (aka UNC1549, Smoke Sandstorm, and APT35), which operates on behalf of Iran's Islamic Revolutionary Guard Corps (IRGC), compromised a maritime vessel's Automatic Identification System (AIS) platform in December 2021, giving it access to critical shipping infrastructure.
[6]
Amazon says it worked with the affected organization to remediate the threat.
Then, in August 2022, Imperial Kitten expanded its targeting to additional ships, and in one instance, broke into CCTV cameras aboard the vessel, providing real-time visual intelligence.
In January 2024, the IRGC's cyber arm began conducting targeted searches for AIS location data for a specific shipping vessel, and on February 1, 2024, US Central Command reported a missile strike by Houthi forces against that ship. "While the missile strike was ultimately ineffective, the correlation between the cyber reconnaissance and kinetic strike is unmistakable," Moses wrote.
[7]
In a more recent example: Amazon tracked [8]MuddyWater (aka Seedworm, APT34, OilRig, and TA450), which is linked to Iran's Ministry of Intelligence and Security (MOIS), provisioning a server for a cyber campaign on May 13. On June 17, they used this infrastructure to access another compromised server containing live CCTV streams from Jerusalem, allowing the crew to surveil the city for potential targets.
And on June 23, "Iran launches widespread missile attacks against Jerusalem. On the same day, Israeli authorities report that Iranian forces were exploiting compromised security cameras to gather real-time intelligence and adjust missile targeting."
It's not just Iran combining cyber and physical warfare. There have also been reports of [9]Russia hacking into surveillance cameras to coordinate its attack on Kyiv. "We know that Iran and Russia both have a very tight intelligence-sharing relationship," Schmidt told The Register.
Then, there's China. "We certainly have seen the [10]Chinese continue down the path that they've been on, which is both [11]pre-positioning for access , but also intentionally combining intelligence gathering and physical world attacks," he added. "A public example of that was when they compromised the [12]water and electrical systems on Guam ."
[13]Amazon CISO: Iranian hacking crews 'on high alert' since Israel attack
[14]Despite Russia warnings, Western critical infrastructure remains unprepared
[15]Why is China deep in US networks? 'They're preparing for war,' HR McMaster tells lawmakers
[16]Chinese spy crew appears to be preparing for conflict by backdooring 75+ critical orgs
Network defenders working to combat these types of cyber-enabled kinetic attacks must expand their threat models and improve intelligence sharing, according to Amazon.
"The first thing organizations need to do is make an intentional decision to look at the two domains together, to understand how their physical world and their logical world are connected," Schmidt said. "For example: How are the lights controlled in my corporate headquarters? If the building is at all modern, they're probably controlled via some internet connected system. How is that system protected? Who's watching it? Who's responsible?"
The next step, he said, is to understand the supply chain components of each part of the business: "Where are they physically located? How are they shipped in and out of that location? Where are those shipping documents stored? Who has access to the physical containers along the way? Start down the process of just unraveling all the very complex inter-relations that we have between the physical world and the logical world."
Unfortunately, there's no easy button for this. It's time consuming, tedious work. But, according to Schmidt, it's a critical risk-management practice.
"The physical world and the logical world are interrelated," he said. "If organizations don't view the threat holistically across both of those domains, they will be missing opportunities." ®
Get our [17]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cso&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aR5MCeR6HEa2fS2Yd-e8EgAAABI&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cso&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aR5MCeR6HEa2fS2Yd-e8EgAAABI&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cso&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aR5MCeR6HEa2fS2Yd-e8EgAAABI&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[4] https://aws.amazon.com/blogs/security/new-amazon-threat-intelligence-findings-nation-state-actors-bridging-cyber-and-kinetic-warfare/
[5] https://www.theregister.com/2023/11/10/iran_israel_hamas/
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cso&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aR5MCeR6HEa2fS2Yd-e8EgAAABI&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cso&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aR5MCeR6HEa2fS2Yd-e8EgAAABI&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[8] https://www.theregister.com/2025/10/24/iran_muddywater_campaign/
[9] https://www.yahoo.com/news/russia-hacked-kyiv-surveillance-cameras-132627907.html
[10] https://www.theregister.com/2025/06/09/china_malware_flip_switch_sentinelone/
[11] https://www.theregister.com/2024/02/07/us_chinas_volt_typhoon_attacks/
[12] https://www.theregister.com/2024/12/31/china_cyber_intrusions_2024/
[13] https://www.theregister.com/2025/06/18/amazon_ciso_agentic_acceleration/
[14] https://www.theregister.com/2024/09/18/russia_west_critical_infrastructure/
[15] https://www.theregister.com/2025/05/29/china_preparing_war_mcmaster/
[16] https://www.theregister.com/2025/06/09/china_malware_flip_switch_sentinelone/
[17] https://whitepapers.theregister.com/
Re: To many countries in the world
elsergiovolador
The USA is THE hostile country.
Yes, because current administration is compromised by Russia and Russia is not exactly friendly.
Re: To many countries in the world
Sandtitz
To many countries in the world,
RUSSIA and CHINA are THE hostile countries.
The baltics and many parts of Europe, Ukraine, Georgia, Taiwan, countries around South China Sea. They are engaged in military moves, not just economic warfare. China also flexes its economic muscles whenever it wishes - Russia would too if they had economy that would affect others.
To many readers on this forum, YOU are just a troll.
Meanwhile....
IGotOut
we at Amazon, Google et al will flog your data to whoever wants it
We also will supply equipment that will stop supporting when we get bored and leave them wide open to attack
We allow people to use our infrastructure to launch these attacks
We only care if they don't give us money.
To many countries in the world
The USA is THE hostile country.
How's Canada doing these days, under the stated threat of economic war? And who is going to defend Greenland against American aggression?