Hackers Target Hikvision Cameras in Ukraine With RCE Exploits Amid Russian Airstrikes

Hackers targeted Hikvision surveillance devices in Ukraine during a concentrated surge of remote command execution attempts that coincided with Russian missile and drone strikes.

GreyNoise documented a nine-day increase in exploitation activity from September 23 to October 1, 2026, following preliminary reconnaissance conducted on September 21. However, researchers could not establish a direct connection between the cyber activity and the airstrikes.

This activity focused on CVE-2021-36260, a critical command injection vulnerability affecting the web server in certain Hikvision products.

The National Institute of Standards and Technology (NIST) assigned this flaw a CVSS score of 9.8, indicating that it is remotely exploitable without requiring authentication or user interaction.

Insufficient input validation allows specially crafted messages containing malicious commands to trigger execution on vulnerable devices.

Hackers Target Hikvision Cameras

GreyNoise’s timeline indicates that a Ukrainian network address initially sent connection attempts to service ports without successfully delivering an exploit.

Two days later, exploitation attempts surged sharply from an almost nonexistent baseline. Four IP addresses generated nearly all observed activity during this period.

Attacks continued through September 27, with every recorded request from these addresses carrying the same command test and no installation attempts.

GreyNoise documented the final attempts on October 1 and noted no further activity from the four addresses through October 7. This telemetry reflects attempted exploitation, not confirmed compromises of operational cameras or recorders.

According to the GreyNoise report, the attackers utilized a publicly available Nuclei template titled “Hikvision IP Camera/NVR – Remote Command Execution.”

Researchers also observed increased exploitation attempts globally; however, the four addresses did not target GreyNoise sensors outside of Ukraine.

The report identified three PureVPN exit addresses: 195.238.124.178, 195.238.124.181, and 195.238.124.188. All three were associated with AS56630 and commercial VPN infrastructure in Lithuania. A fourth address operated on a domestic Ukrainian network; its exact IP was not disclosed.

GreyNoise assessed the PureVPN-associated activity as attributable to a single entity, while assigning low confidence to any connection with the Ukrainian address.

Shared VPN exits can carry traffic from unrelated users, meaning that infrastructure overlap does not provide sufficient evidence of common ownership or state sponsorship.

The timing of these attacks raises concerns, as compromised surveillance systems could provide visual intelligence before, during, or after military strikes.

Nevertheless, GreyNoise explicitly states that it cannot confirm whether the observed exploitation attempts were related to the Russian airstrikes. The published timeline does not demonstrate footage collection, malware deployment, or attribution to a Russian operator.

CVE-2021-36260 appears in the Cybersecurity and Infrastructure Security Agency (CISA)’s Known Exploited Vulnerabilities catalog, which lists remediation steps that include applying updates according to vendor instructions.

For affected Hikvision deployments, firmware remediation remains the priority, rather than assuming that the apparent cessation of this campaign means the vulnerable equipment is now safe from exploitation.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC .

Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.

CastleStealer Malware Bypasses Chromium ABE and Adds Remote Command Execution Capabilities

CastleStealer, a C# information stealer first publicly identified in April 2026, has expanded its capabilities…

Cisco Talos Warns AI Agent Swarms Can Compress Cyberattacks From Months to Hours

Cisco Talos warns that coordinated AI agent swarms could radically shorten the time needed to…

Suspected TraderTraitor Hackers Trojanize Terraform Provider to Deploy Cross-Platform Malware

A campaign in July 2026 using a trojanized Terraform provider to deploy cross-platform malware against…

12 Best Software Supply Chain Security Tools Compared (2026): Features & Pricing

Chainguard leads the eliminate-the-problem lane with hardened zero-CVE images, Sonatype the block-at-ingestion lane, and Scribe/Lineaje…

11 Best API Security Tools Compared (2026): Features & Pricing

Salt Security and Traceable anchor dedicated discovery-plus-runtime defense, 42Crunch owns design-time contract security, and the…

FBI Disrupts Major Scam Centers in Ghana, 130+ Detained and 300+ Devices Seized

The FBI has announced another disruption of scam centers in Ghana as part of Operation…