Hackers Target Hikvision Cameras in Ukraine With RCE Exploits Amid Russian Airstrikes
GreyNoise saw exploitation attempts against Ukrainian Hikvision cameras using CVE-2021-36260, with no confirmed strike link.
GreyNoise reported a surge from September 23 to October 1, 2026, of remote command-execution attempts against Hikvision devices in Ukraine, after reconnaissance on September 21. The attempts targeted CVE-2021-36260, a critical unauthenticated command-injection flaw scored CVSS 9.8 and listed in CISA's Known Exploited Vulnerabilities catalog. Four addresses, three of them PureVPN exits in Lithuania on AS56630, accounted for nearly all Ukraine-only activity and used a public Nuclei template. GreyNoise recorded no confirmed compromises and said it could not link the attempts to concurrent Russian missile and drone strikes.
- CVE-2021-36260 is an unauthenticated Hikvision command-injection bug scored CVSS 9.8.
- GreyNoise saw a surge of attempts from September 23 to October 1, 2026.
- Four IPs, three Lithuanian PureVPN exits, focused on Ukraine.
- Attackers used a public Nuclei template; no camera compromises were confirmed.
- GreyNoise could not tie the activity to Russian airstrikes.
- CVEs
- CVE-2021-36260
- Vendors
- Hikvision
- Products
- Hikvision IP CameraHikvision NVR
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2021-36260 | Unauthenticated Command Injection in Hikvision Device Web Server | 9.8 | 100% | KEVPoC ×3 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 195.238.124.178 | kraine. The report identified three PureVPN exit addresses: 195.238.124.178, 195.238.124.181, and 195.238.124.188. All three were assoc |
| ipv4 | 195.238.124.181 | t identified three PureVPN exit addresses: 195.238.124.178, 195.238.124.181, and 195.238.124.188. All three were associated with AS5663 |
| ipv4 | 195.238.124.188 | reVPN exit addresses: 195.238.124.178, 195.238.124.181, and 195.238.124.188. All three were associated with AS56630 and commercial VPN |
From the original article
2 min read at gbhackers.com
Hackers targeted Hikvision surveillance devices in Ukraine during a concentrated surge of remote command execution attempts that coincided with Russian missile and drone strikes. GreyNoise documented a nine-day increase in exploitation activity from September 23 to October 1, 2026, following preliminary reconnaissance conducted on September 21. However, researchers could not establish a direct connection between […]
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.