IoT camera compromise exposes the limits of network segmentation

At a glance

What this is: This is a threat analysis of Iranian state actors abusing vulnerable Hikvision and Dahua IoT cameras as reconnaissance platforms, with the key finding that network segmentation fails when device trust and east-west access are too broad.

Why it matters: IAM, PAM, and network security teams need to treat unmanaged IoT devices as governed access paths, not passive assets, because compromised cameras can become internal footholds that bypass endpoint controls and support lateral movement.

By the numbers:

• Five known vulnerabilities were used against Hikvision and Dahua cameras in the March 2026 campaign, according to Elisity.

Context

IoT camera security is not just an endpoint problem. Cameras sit inside trust zones that often rely on VLANs, ACLs, and broad device classes rather than per-device governance, which means one compromised camera can become an internal launch point for discovery and movement.

This article uses the Iranian camera campaign to show why segmentation by location or network segment is a weak control when embedded devices are unmanaged, long-lived, and difficult to instrument. The identity question is not human login access, but device identity, ownership, and the authority to talk laterally inside the network.

Key questions

Q: What breaks when IoT cameras are left on broad internal network segments?

A: Broad internal segments turn a camera compromise into an internal foothold. Once an attacker gains code execution on the device, they can scan adjacent systems, probe management services, and pivot laterally because the network already trusts the camera more than it should. The failure is containment, not just detection, so the blast radius expands inside the enterprise.

Q: Why does IoT sprawl increase lateral movement risk for attackers?

A: IoT sprawl increases risk because every connected device can become a foothold if it is weakly secured, poorly patched, or overly trusted. Once inside, an attacker can move across flat networks, exploit shared credentials, or pivot into business systems. The more unmanaged devices an enterprise has, the more paths exist for compromise to spread beyond the original entry point.

Q: What are the signs that IoT segmentation is failing in practice?

A: Warning signs include camera traffic that suddenly scans subnets, talks to new internal hosts, or reaches services outside its normal video-management path. Another signal is when segmentation depends on exceptions, manual ACL growth, or MAC-based NAC workarounds. Those patterns show that policy is being maintained by memory and process rather than enforced by the network.

Q: How should security teams govern devices that cannot run endpoint agents?

A: Security teams should govern them through device identity, explicit ownership, and infrastructure-enforced communication limits. If the device cannot support an agent, policy has to move to the network edge, where allowed flows can be constrained to a small set of business-required destinations. That approach reduces blast radius without depending on unsupported tooling.

Technical breakdown

Why compromised cameras become internal footholds

A camera compromise is valuable because the device already sits inside the enterprise network and is trusted to reach a small set of internal services. Once code execution is gained, the camera can scan adjacent subnets, enumerate services, and probe for reachable management interfaces. Embedded devices rarely have endpoint detection, so the attacker’s activity blends into normal device traffic. That makes the camera a durable beachhead for discovery, staging, and pivoting. The real architectural weakness is that the device is allowed to exist with more network reach than its function requires.

Practical implication: Restrict each camera to only the services it must reach, and remove broad east-west access paths.

Why VLANs, ACLs, and NAC struggle with IoT identity

VLANs group devices by location, not by trust requirement, so a compromise in one zone can still expose every device in that zone. ACLs can be precise in theory, but they degrade operationally as device counts grow and exceptions accumulate. NAC is also a poor fit because most IoT devices cannot support 802.1X or posture checks, forcing weak fallback methods such as MAC-based admission. None of these controls binds policy tightly enough to the device’s actual purpose, which is why the segmentation model collapses under pressure.

Practical implication: Use device identity and function to drive policy, not switch location or manual exception lists.

How east-west movement turns a camera into a staging point

East-west movement is the core risk because the attacker does not need to leave the internal network boundary to spread. A compromised camera can host scanning tools, relay commands, or transfer payloads to newly discovered hosts. That is why firewalls placed only at perimeter or zone boundaries miss the more important traffic. The attacker’s objective is to move from low-value embedded hardware to higher-value servers, management systems, or data stores while avoiding endpoint monitoring.

Practical implication: Enforce per-device lateral movement limits at the network edge so internal pivots are blocked before they begin.

Threat narrative

Attacker objective: The objective was to turn compromised IoT cameras into trusted internal reconnaissance nodes that could support further access and operational intelligence gathering.

1. Entry occurred when Iranian state actors exploited five known Hikvision and Dahua vulnerabilities in internet-exposed cameras, gaining code execution on embedded devices inside organizational networks.
2. Credential or device trust abuse followed because the compromised cameras were already permitted to communicate across internal segments and management paths that were broader than their function required.
3. Lateral movement then became possible as attackers used the cameras for discovery, service probing, and pivoting toward higher-value systems while avoiding traditional endpoint controls.
4. The impact was the conversion of surveillance infrastructure into reconnaissance tooling that supported military operations and expanded the attacker’s internal reach.

Breaches seen in the wild

• JumpCloud breach 2023: North Korean hackers breached JumpCloud and abused its device commands framework against a few customers; all admin API keys were reset.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Static segmentation is not a containment strategy when devices are allowed broad east-west trust. VLANs and ACLs often describe where a device sits, not what it may do. That distinction matters because a compromised camera does not need to escape the perimeter to become useful to an attacker. Practitioners should treat the device’s permitted communications as the real security boundary.

IoT device identity is the governance gap hiding behind network policy. Cameras, readers, and controllers are commonly managed as asset classes instead of as individually governed identities with explicit purpose, ownership, and connectivity limits. That creates a blind spot for IAM-adjacent governance because the network still needs to decide what a device may access. The correct question is not whether the device is on a trusted VLAN, but whether its identity is constrained to the minimum necessary flows.

Microsegmentation becomes a resilience control, not just a design preference, once endpoint agents are impossible. Embedded systems cannot absorb the same controls as laptops or servers, so the security model has to move into the infrastructure. This is where policy tied to device identity, function, and permitted service reach becomes essential. Practitioners should regard that shift as a structural requirement for IoT risk reduction, not an optimisation.

Camera compromise exposes a standing privilege problem for the entire device estate. The issue is not only that one camera was vulnerable, but that the enterprise had granted a durable network position to hardware that could not be continuously inspected or reliably controlled. That is a governance failure in the use of trust, and it should force a re-evaluation of who owns device connectivity decisions and how those decisions are reviewed.

Identity-based microsegmentation is the named concept this campaign sharpens. It is the practice of binding network enforcement to the actual identity and function of a device rather than its subnet or location. That model matters because it gives defenders a way to shrink blast radius even when the endpoint itself cannot run an agent. Practitioners should adopt it where IoT or OT devices create unavoidable internal exposure.

What this signals

Identity-based microsegmentation is the practical response when endpoint controls cannot be installed. IoT cameras, readers, and controllers should be treated as governed identities with narrow communication rights, not as passive infrastructure. That shift matters because it gives security teams a way to contain compromise at the network edge instead of relying on impossible endpoint instrumentation.

The governance lesson is that segmentation only works when policy follows device purpose. If a camera can reach broad internal services, the organisation has already lost the assumption that the network boundary is a meaningful control.

For practitioners

• Map every camera to a named owner and business function Assign explicit ownership for each camera estate so that no device is left in the IT and facilities gap. Inventory should include firmware version, placement, and the exact internal services each device is permitted to reach.
• Replace flat camera VLAN trust with device-specific flow rules Define per-device communication policy for cameras, allowing only the video management system, required update services, and any approved management endpoints. Block all other east-west paths by default.
• Remove dependency on NAC fallback methods for IoT admission Treat MAC-based admission as an admission convenience, not a security control, and avoid assuming posture checks that cameras cannot support. Build enforcement around identity and function at the switch or access edge.
• Hunt for cameras that scan, stage, or talk like hosts Create detections for camera subnet reconnaissance, unexpected SSH or SMB use, and unusual transfers from embedded devices. Those behaviours indicate that a compromised camera has moved from passive sensor to active foothold.

Key takeaways

• The incident shows that IoT cameras can become internal reconnaissance platforms when network trust is broader than device function.
• The scale of the risk comes from the combination of embedded-device exposure, weak ownership, and east-west reach that standard endpoint controls cannot cover.
• The control implication is to govern cameras by identity and allowed flows, not by VLAN membership or static network location.

Key terms

• Identity-based Microsegmentation: A segmentation approach that uses identity, context, and policy to decide whether a connection should be allowed inside a network zone. In OT, it helps reduce lateral movement without relying only on IP addresses or broad subnet rules.
• Standing East-West Access: Standing east-west access is persistent internal reachability between systems that remains open whether or not it is currently needed. It is a governance problem because it expands the blast radius of a single compromised identity and makes lateral movement easier to achieve and harder to contain.
• Embedded device: An embedded device is a purpose-built system designed to perform a narrow function, such as video capture, badge reading, or environmental control. These devices usually run constrained firmware, support limited monitoring, and cannot accommodate the same security tooling used on general-purpose endpoints.
• Network Segmentation: Network segmentation divides traffic and resources into controlled zones so access can be restricted between groups, systems, or applications. In remote access design, segmentation limits what a connected user or workload can reach after authentication, which reduces lateral movement and shrinks blast radius.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, and secrets management. It helps practitioners connect identity control to the broader access decisions that shape security outcomes.