New Amazon Threat Intelligence findings: Nation-state actors bridging cyber and kinetic warfare

This article presents Amazon Threat Intelligence findings on nation-state actors using cyber operations to enable physical military attacks, termed "cyber-enabled kinetic targeting."

• Nation-state actors systematically use cyber reconnaissance to support kinetic military operations
• Imperial Kitten compromised maritime vessels' AIS and CCTV systems before Houthi missile strikes
• MuddyWater accessed Jerusalem CCTV feeds before Iranian missile attacks on the city
• Threat actors use VPN networks, dedicated servers, and compromised enterprise systems for operations
• Real-time camera feeds provide actionable targeting intelligence for physical attacks
• Organizations must expand threat models to include cyber-enabled kinetic targeting risks
• Critical infrastructure operators should assume systems may be targeted for tactical intelligence

The research demonstrates that cyber and kinetic warfare are increasingly integrated, requiring defenders to adopt new threat models and enhance intelligence sharing across sectors.