Hikvision Camera Attacks Target Ukrainian Infrastructure
For nine consecutive days, unidentified threat actors relentlessly assaulted Hikvision cameras stationed throughout Ukraine, aggressively attempting to exploit a critical, five-year-old vulnerability.
Cybersecurity analysts at GreyNoise documented a precipitous escalation in infiltration attempts targeting internet-connected cameras and digital video recorders between September 23 and October 1, 2026. Prior to the commencement of this orchestrated campaign, such localized attacks had been virtually non-existent since July. Notably, nearly the entirety of the intercepted traffic originated from a mere four IP addresses. Furthermore, these suspicious queries were directed exclusively toward vulnerable devices physically located within Ukrainian territory.
Exploiting CVE-2021-36260
The primary vector of this assault was CVE-2021-36260, a catastrophic vulnerability initially discovered in 2021. This severe flaw grants an attacker the ability to execute arbitrary commands remotely on specific Hikvision devices, entirely circumventing the need for passwords or any form of authorization. Consequently, the vulnerability earned a terrifying 9.8 severity score on the CVSS scale. Although the manufacturer released a comprehensive patch years ago, a substantial multitude of cameras operating on antiquated firmware persist as highly lucrative, potential targets for such opportunistic attacks.
The assailants utilized a publicly accessible Nuclei template, specifically engineered to verify the feasibility of remote command execution on IP cameras and network video recorders. Every request emanating from the four identified IP addresses contained an identical diagnostic command, conspicuously devoid of any immediate attempt to deploy a malicious payload. While this specific activity effectively identifies vulnerable hardware, it does not inherently confirm the successful compromise or full acquisition of the targeted equipment.
The Mechanics of the Surveillance Assault
Three of the offending IP addresses were definitively traced to exit nodes belonging to PureVPN, a commercial Virtual Private Network service, physically situated in Lithuania. The fourth address was localized within a Ukrainian network. GreyNoise analysts assess with a high degree of probability that a singular operator orchestrated the traffic routed through the VPN; however, they evaluate the direct correlation with the Ukrainian IP address with notably lower confidence. The initial exploratory connection attempts materialized on September 21. Aggressive, active exploitation commenced two days later, eventually culminating abruptly on October 1.
The hyper-specific geographic targeting of this campaign particularly captivated the researchers’ attention. While analogous attacks against surveillance cameras frequently register globally, these four specific IP addresses completely abstained from probing GreyNoise sensors situated anywhere outside of Ukraine. The potential commandeering of localized video surveillance infrastructure grants hostile actors the invaluable ability to meticulously study regional topography and intimately monitor physical movements entirely devoid of an actual physical presence.
GreyNoise has not yet conclusively identified the perpetrators behind these attacks. Furthermore, they have not definitively confirmed unauthorized access to active video streams, nor have they unearthed concrete evidence verifying the successful, lasting infection of targeted devices resulting directly from this specific campaign.
Analysts report a total cessation of exploitation attempts originating from the identified addresses. Owners and administrators of Hikvision surveillance equipment are vehemently urged to rigorously verify their firmware iterations, immediately deploy all available security patches, and decisively restrict direct internet exposure to their hardware. Even ancient, universally documented Hikvision vulnerabilities retain an extraordinarily high degree of peril if the devices are permitted to operate indefinitely without the requisite security updates.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
