Ping First, Boom Second

Ping First, Boom Second

Speakers: Dlshad Othman, David Magnotti, Principal Engineer, Amazon

Conference: CYBERWARCON

YouTube: https://www.youtube.com/watch?v=bCAbs7ke61A

Overview

In an increasingly interconnected world, the lines between cyber operations and kinetic military action are blurring in unprecedented ways. This talk, "Ping First, Boom Second," delivered by David Magnotti, Principal Engineer with Amazon Threat Intelligence, and Dlshad Othman, sheds light on a disturbing new trend: cyber-enabled kinetic targeting. Unlike traditional cyber-kinetic attacks that aim to cause physical damage through digital means (e.g., Stuxnet) or broad hybrid warfare concepts, this specific phenomenon involves threat actors leveraging compromised digital infrastructure as real-time sensors to refine and enable physical military strikes.

The presentation delves into Amazon's unique threat intelligence capabilities, combining first-party telemetry, customer security events, and industry collaboration to uncover these sophisticated operations. Through two compelling case studies involving Iranian state-sponsored groups, Muddy Water and Imperial Kitten, the speakers illustrate how adversaries are actively integrating computer network operations into their immediate military planning cycles. This shift signifies a critical evolution in the threat landscape, where the urgency of cyber defense extends beyond data theft to the prevention of direct physical harm and the redefinition of what constitutes critical infrastructure.

The implications of this trend are profound, challenging traditional notions of cyber defense and intelligence sharing. As more physical infrastructure becomes digitally connected, the attack surface for such operations expands dramatically. Defenders are urged to recognize that seemingly benign reconnaissance activities against systems like CCTV cameras, IoT devices, and maritime navigation platforms can serve as precursors to kinetic attacks, demanding a re-evaluation of asset inventory, monitoring, and defensive strategies. This talk serves as a crucial warning and a call to action for the global security community to adapt to this evolving threat paradigm.

Background

▶ Watch: New trend: Cyber for kinetic military strikes (0:00)

Amazon's threat intelligence investigations are underpinned by a robust, multi-faceted data collection and analysis framework. This approach allows them to correlate seemingly disparate events and uncover sophisticated operational trends like cyber-enabled kinetic targeting. The primary data sources include:

1. First-Party Telemetry from AWS: This encompasses a vast array of information collected from Amazon's own cloud infrastructure. Key components include data from honeypots, such as the proprietary Mad Pot system, which allows researchers to observe adversary tactics, techniques, and procedures (TTPs) in a controlled environment. Crucially, Amazon also collects extensive network flow data, often referred to as NetFlow. This metadata details interactions between AWS IP addresses and other IP addresses, including source and destination ports, connection sizes, and request counts. While it deliberately excludes the actual content of network traffic for privacy, NetFlow is invaluable for identifying suspicious patterns like beaconing – where a compromised server repeatedly contacts an external IP address with consistent timing and connection characteristics, indicative of a command and control (C2) channel.

1. Customer Security Events: Amazon actively engages with customers who opt into threat intelligence sharing. When malicious activity is identified affecting a customer, Amazon proactively notifies them. During this process, customers are invited to share relevant information about the threat activity, which significantly enhances Amazon's understanding of adversary operations and tactics. This collaborative feedback loop is vital for enriching the overall threat intelligence picture.

1. Collaboration with Industry Partners: Recognizing that no single entity can comprehensively understand the global threat landscape, Amazon actively collaborates with other organizations in the cybersecurity industry. This partnership enables a broader perspective on how various threats operate, facilitating more effective mitigation strategies across the ecosystem.

The core methodology employed by Amazon threat intelligence involves correlating observed cyber activity, which might initially appear as benign reconnaissance, with subsequent publicly disclosed kinetic military strikes and intelligence shared by partners. The speakers emphasize a critical caveat: Amazon does not possess direct insight into adversary military planning. Instead, their assessments are inferences drawn from the rigorous correlation of cyber indicators with real-world events. This nuanced approach acknowledges the inherent limitations of threat intelligence while still enabling high-confidence conclusions about adversary intent and operational integration. This methodology is crucial for identifying emerging trends like cyber-enabled kinetic targeting, which sits distinctly apart from "cyber-kinetic" operations (e.g., Stuxnet, which causes physical damage through cyber means) and the broader concept of "hybrid warfare." It defines a specific intersection where computer network operations directly inform and enable physical military strikes, using compromised physical sensors as forward observers.

Key Findings

▶ Watch: Case Study 1: Muddy Water compromises Jerusalem CCTV for strikes (4:20)

The talk "Ping First, Boom Second" unveiled a critical and evolving dimension of state-sponsored cyber operations, presenting several key findings that redefine the intersection of cyber and kinetic warfare:

• Emergence of Cyber-Enabled Kinetic Targeting: The primary finding is the identification of a distinct and growing trend where threat actors are systematically conducting cyber reconnaissance against specific entities that are subsequently targeted by kinetic military activities. This is not incidental but a deliberate integration of cyber operations into active military planning.
• High Operational Tempo: A striking characteristic of these operations is their rapid execution. The timeframe between observed cyber reconnaissance and subsequent kinetic strikes is remarkably short, often measured in days rather than weeks or months. This compressed operational tempo strongly indicates that the cyber activity is directly linked to immediate military objectives, rather than long-term intelligence gathering.
• Reconnaissance for Attack, Not Just Intelligence: Unlike traditional intelligence collection, where cyber espionage might gather data for future analysis or strategic advantage, these operations involve reconnaissance specifically tailored to facilitate an imminent attack. The compromised systems function as real-time "forward observers" or "sensors" for first-strike planning, providing adversaries with critical, up-to-the-minute situational awareness.
• Integration with Active Military Planning: The short timelines and precise targeting suggest that these cyber operations are deeply integrated into the adversary's active military planning cycles. They are not merely parallel activities but integral components that directly inform and enable the timing and precision of kinetic engagements.
• Compromised Infrastructure as Real-Time Sensors: The talk highlights that seemingly innocuous compromised infrastructure – such as CCTV cameras, IoT devices, or maritime Automatic Identification Systems (AIS) – are being weaponized. These systems are transformed into sophisticated, real-time intelligence assets, providing adversaries with live feeds, location data, and other critical information necessary for targeting.
• Expanded Definition of Critical Infrastructure: Consequently, the traditional understanding of "critical infrastructure" must broaden. Beyond conventional targets like water utilities and electric companies, assets such as camera systems, various IoT devices, Geographic Information System (GIS) platforms, and GPS sensors that offer situational awareness are now potential components of kinetic targeting cycles. These assets require the same rigorous inventory, monitoring, and defense as traditional critical infrastructure.

These findings collectively point to a significant escalation in the sophistication and direct impact of cyber operations, underscoring the urgent need for defenders to adapt their strategies to counter this emerging threat.

Technical Deep Dive

▶ Watch: Case Study 2: Imperial Kitten targets maritime vessel for missile strikes (6:50)

The core of the presentation lies in two detailed case studies, each illustrating the mechanics and implications of cyber-enabled kinetic targeting by Iranian state-sponsored groups. These investigations were made possible through Amazon's extensive network flow analysis and collaborative intelligence efforts.

Case Study 1: Muddy Water (Iran's MOIS)

The first case study focuses on Muddy Water, an Iranian threat actor attributed by the FBI and US Cyber Command to Iran's Ministry of Intelligence and Security (MOIS). Active since 2017, Muddy Water has historically targeted government, defense, and international sectors, evolving from less sophisticated operations to complex, multi-staged attacks. This particular investigation revealed a significant shift in their behavior towards kinetic enablement.

Operational Approach:

Amazon's network flow analysis played a crucial role in uncovering Muddy Water's operational methodology. The actor was observed routing their traffic through a Virtual Private Network (VPN) network to infrastructure they directly controlled. This actor-controlled infrastructure then served as the staging ground for connecting to and compromising enterprise servers.

Target and Compromise:

In this instance, the specific target was an enterprise server streaming CCTV camera feed from Jerusalem. The compromise allowed Muddy Water to deploy their custom command and control (C2) framework, ensuring a persistent connection with the compromised environment. This persistence was key to maintaining real-time visibility.

Timeline of Events:

• May 13, 2025: Muddy Water provisioned their dedicated infrastructure (a server).
• June 13, 2025: Exactly one month later, Amazon's analysis revealed the actor using this infrastructure to communicate with and access the enterprise server streaming CCTV footage from Jerusalem.
• June 23, 2025: Just six days after the observed cyber activity, Iran launched missile attacks on Jerusalem. On the very same day, Israeli authorities publicly reported that Iranian threat actors were compromising CCTV cameras specifically to refine their missile targeting.

Validation:

This public reporting from Israeli authorities served as critical validation for Amazon's technical analysis. It confirmed the "why" behind the observed compromises, illustrating a direct link between the cyber intrusion and subsequent kinetic military action. The CCTV feed effectively functioned as a real-time "forward observer" for the missile strikes.

Case Study 2: Imperial Kitten (Iran's IRGC)

The second case study involves Imperial Kitten, also known as Crimson Sandstorm, an actor attributed by the intelligence community and CrowdStrike to Iran's Islamic Revolutionary Guard Corps (IRGC). This group focuses on strategic intelligence collection, particularly targeting maritime defense, government, and other strategic sectors. From Amazon's visibility, Imperial Kitten has systematically expanded its access and targeting within the maritime sector.

Operational Approach and Target:

This alarming activity began around December 2021 when Amazon observed Imperial Kitten compromising a maritime platform. Amazon detected the intrusion and collaborated with the impacted organization to conduct incident response and identify the scope of the activity.

Escalation and Advanced Reconnaissance:

• August 2022: The actor expanded their maritime access. In one specific intrusion, they gained access to the CCTV feed directly from a vessel, providing them with full, real-time visibility of the ship.
• January 2024: Imperial Kitten conducted multiple searches for Automatic Identification System (AIS) location data. AIS is a crucial maritime navigation safety system that broadcasts real-time data, including a vessel's actual location, course, speed, and other identifying information. Accessing this data provides minute-by-minute, live situational awareness, which is invaluable for kinetic targeting.

Timeline of Events:

• December 2021: Initial compromise of a maritime platform.
• August 2022: Access gained to vessel CCTV feeds.
• January 2024: Extensive searches for AIS data on a specific vessel.
• February 1, 2024: Just five days after Amazon identified the AIS reconnaissance, the US Central Command (CENTCOM) reported that Houthi forces launched missile strikes against the same vessel. Fortunately, the missiles missed, and no one was harmed.

Validation:

CENTCOM's public statement explicitly confirmed the missile engagement on February 1st, noting that two missiles were launched from Houthi-controlled areas in Yemen and ultimately missed the targeted vessel. This public reporting directly corroborated Amazon's intelligence, demonstrating Imperial Kitten's cyber activities were a direct precursor to a kinetic strike attempt.

Both case studies unequivocally demonstrate a sophisticated and alarming integration of cyber operations into military planning, where compromised digital assets are leveraged as critical components for real-time targeting and physical strike enablement. The rapid operational tempo observed in both instances underscores the immediate and direct link between the cyber reconnaissance and the subsequent kinetic actions.

Demo / Proof of Concept

▶ Watch: Implications for defenders: Defining cyber-enabled kinetic targeting (8:40)

The "Ping First, Boom Second" talk focused on presenting investigative findings and detailed case studies derived from Amazon's extensive threat intelligence operations. It did not include a live demonstration or a proof of concept of the cyber-enabled kinetic targeting methodologies or defensive tools. Instead, the speakers provided a comprehensive analysis of observed adversary behavior, timelines, and technical evidence gathered during their investigations into the Muddy Water and Imperial Kitten campaigns. The emphasis was on sharing actionable intelligence and the implications of this emerging threat rather than showcasing a simulated attack or defense.

Defensive Implications

▶ Watch: Future outlook: Expanding attack surface for physical world visibility (10:00)

The findings presented in "Ping First, Boom Second" carry significant and urgent implications for defenders across all sectors, particularly those operating critical infrastructure or managing internet-connected physical systems. The emergence of cyber-enabled kinetic targeting demands a fundamental shift in defensive strategies and threat intelligence sharing.

Firstly, the most critical implication is the redefinition of critical infrastructure. It is no longer sufficient to solely focus on traditional assets like power grids, water utilities, or financial systems. The presented case studies clearly demonstrate that any system providing real-time situational awareness or sensor data – including CCTV camera systems, various Internet of Things (IoT) devices, Geographic Information System ( (GIS) platforms, and Global Positioning System (GPS) sensors – is now a potential target for military reconnaissance. These assets, often overlooked in high-priority security assessments, must now be rigorously inventoried, continuously monitored, and defended with the understanding that their compromise could directly facilitate physical harm.

Secondly, the urgency of threat intelligence sharing must be re-evaluated. When identifying an organization or infrastructure targeted in a conflict zone, the stakes are dramatically higher than preventing data theft or business disruption. The potential for physical harm or kinetic strikes necessitates immediate and highly prioritized intelligence dissemination to relevant parties, including government agencies, law enforcement, and the impacted entities themselves. The traditional timelines for intelligence sharing may be too slow given the rapid operational tempo observed in these campaigns (days, not weeks).

Thirdly, defenders must prepare for a new adversary motivation. Threat actors engaged in cyber-enabled kinetic targeting are not primarily after data exfiltration, financial gain, or ransomware payloads. Their objective is sensors and visibility into the physical world. This means security teams need to adjust their monitoring strategies to detect anomalous access to camera feeds, location data (like AIS), environmental sensors, or other systems that provide real-time physical awareness. Behavioral analytics on network flow data (NetFlow) becomes even more crucial for identifying patterns indicative of reconnaissance for kinetic purposes.

Looking ahead, this trend is expected to continue and expand. As the global physical infrastructure becomes increasingly interconnected and digitized, the attack surface for cyber-enabled kinetic targeting will only grow. Defenders must anticipate that more physical systems will be integrated into military planning cycles. This necessitates proactive security measures, including:

• Comprehensive Asset Inventory: Identify all internet-connected devices, especially those providing any form of physical world visibility.
• Enhanced Monitoring: Implement robust logging and anomaly detection for access to sensor data, video feeds, and location services.
• Network Segmentation: Isolate critical physical sensors from broader enterprise networks to limit lateral movement if a compromise occurs.
• Patch Management: Ensure all IoT devices, cameras, and GIS systems are kept up-to-date with the latest security patches.
• Zero Trust Principles: Apply least privilege access and continuous verification for all users and devices interacting with these critical systems.
• Incident Response Planning: Develop specific incident response playbooks for scenarios where a cyber intrusion could lead to kinetic implications.

Amazon also noted that further information, including Indicators of Compromise (IoCs) related to the discussed activity, was published in a post on the AWS Security Blog, providing actionable intelligence for defenders to implement immediate protections. This collaborative approach between threat intelligence providers and the broader security community is vital in mitigating this evolving and dangerous threat.

Key Takeaways

• Cyber-Enabled Kinetic Targeting is a Growing Threat: Adversaries are directly integrating computer network operations into their military planning to refine and enable physical (kinetic) strikes, using compromised digital assets as real-time sensors.
• High Operational Tempo: The timeframe between cyber reconnaissance and kinetic attacks is extremely short, often days, indicating a direct link to immediate military objectives rather than long-term intelligence gathering.
• Expanded Definition of Critical Infrastructure: Systems providing real-time physical visibility—such as CCTV cameras, IoT devices, GIS platforms, and GPS sensors—are now critical targets for kinetic enablement and must be defended accordingly.
• Reconnaissance for Attack: The primary goal of these cyber operations is to gather intelligence for an imminent attack, shifting the focus from data theft to acquiring situational awareness for physical targeting.
• Iranian State-Sponsored Actors are Active: Groups like Muddy Water (MOIS) and Imperial Kitten (IRGC) have been observed leveraging compromised CCTV feeds and AIS data to facilitate missile strikes, demonstrating the real-world impact of this threat.
• Urgent Need for Intelligence Sharing: The potential for physical harm necessitates rapid and prioritized sharing of threat intelligence, especially for entities in conflict zones, to enable timely defensive actions.

About the Speaker(s)

David Magnotti is a Principal Engineer with Amazon Threat Intelligence. His work involves leading investigations into advanced threat actors and emerging trends in the cybersecurity landscape, leveraging Amazon's extensive telemetry and intelligence capabilities.

Dlshad Othman presented alongside David Magnotti, contributing to the detailed analysis of the case studies. While his specific title was not mentioned in the transcript's introduction, his role in presenting the technical investigations suggests a significant contribution to Amazon's threat intelligence efforts.