Spike in attacks targeting digital video recorders in Ukraine
Summary: GreyNoise observed a rise in scanning and exploitation attempts against Digital Video Recorders in Ukraine between 21 September and 1 October 2026, coinciding with an escalation in Russian strikes. Most of the activity targeted CVE-2021-36260, an unauthenticated command injection flaw in unpatched Hikvision products, and came from three PureVPN exit nodes and one Ukrainian domestic IP address.
Key Takeaway: Compromised DVRs can give an attacker the ability to physically survey an area for battlespace awareness before, during, and after kinetic strikes, and the four IPs involved did not touch GreyNoise sensors outside Ukraine.
Read the original at GreyNoise Blog ↗
- Mentions
- CVE-2021-36260
- Related
- CVE-2021-36260: Hikvision Improper Input Validation Known Exploited Vulnerabilities · Jan 10, 2022At The Edge Clear: June 08 - 15, 2026 Cyber Risks ·At The Edge Clear: June 15 - 23, 2026 Cyber Risks ·