Loading story…
GreyNoise identified a surge in scanning and exploitation attempts against Hikvision surveillance devices in Ukraine between September 21 and October 1, 2026, with exploitation concentrated in a nine-day period beginning September 23. Most attempts targeted CVE-2021-36260, a critical unauthenticated command-injection vulnerability with a CVSS score of 9.8. Three PureVPN exit nodes and one Ukrainian domestic IP address generated almost all observed attempts; none attempted exploitation against GreyNoise sensors outside Ukraine. Whether the addresses shared a common operator remains unknown.
All recorded requests from the four addresses used the same command-execution test from a public Nuclei template, without an installation payload. The observations do not confirm device compromise, malware installation, or access to video feeds. Although the activity coincided with intensified Russian missile and drone strikes, researchers established neither a connection nor attribution to Russian actors. Organizations operating Hikvision equipment should apply firmware updates, restrict internet exposure, and isolate surveillance devices from critical networks.
See which actors are running it and whether you're in range.
5 events from the most recent confirmed update back to the earliest known activity.
GreyNoise recorded the last exploitation attempts from the four identified source addresses on October 1. No further attempts from those addresses had been recorded through October 7.
Attempts targeting CVE-2021-36260 rose sharply from near zero, beginning a nine-day surge largely originating from three PureVPN exit nodes and one Ukrainian IP address. Requests used the public Nuclei remote-command-execution template with an identical command test and no installation payload; the observations did not confirm device compromise.
GreyNoise observed an IP address on a domestic Ukrainian network attempting connections to service ports in Ukraine without sending an exploit. The address subsequently became one of four sources responsible for almost all observed exploitation attempts.
Ukrainian authorities reported disabling two cameras that Russian intelligence had compromised to observe Kyiv’s air defenses and infrastructure. This incident does not establish attribution for the later exploitation attempts.
Cybersecurity News reported more than 80,000 exposed Hikvision cameras vulnerable to exploitation. The figure describes exposure reported in 2022, not the number of vulnerable devices during the 2026 campaign.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
MBSD-SOC reported a sharp rise in exploitation attempts against Hikvision network cameras using **`CVE-2021-36260`**, an unauthenticated OS command injection flaw in the products’ web server component. The vulnerability stems from improper input validation and can allow remote code execution as the `root` user by sending crafted requests to the device. The observed attacks used a `PUT` request to `/SDK/webLanguage` and injected commands through XML content, with MBSD-SOC noting detections increased significantly after May 26, 2023. Telemetry showed most attack traffic originated from the United States, followed by Germany, Japan, France, and Romania, underscoring continued broad internet scanning and exploitation of exposed Hikvision devices.
Aug 15, 2026
Researchers at Hunt.io uncovered two exposed directories that revealed parallel intrusion operations targeting internet-exposed infrastructure in Ukraine, particularly IP cameras and routers. One server at `89.208.97[.]165` contained evidence that a Ukrainian OpenCart-based e-commerce site had been compromised through SQL injection and repurposed as a proxy and staging node for Tor-routed intrusion attempts against Ukrainian government and military websites. The same server hosted a custom camera exploitation platform, **camview**, whose recovered data showed 58 compromised Ukrainian cameras, logs of live viewing sessions, and use of the open-source **Ingram** scanner against Dahua, Hikvision, D-Link, and Reolink devices. A second exposed directory at `213.165.63[.]49` showed a separate but similar operation using Russian-language tooling, **Ingram**, and custom scripts to scan and exploit routers and cameras across 15 European countries, with camera targeting concentrated on Ukraine. The toolkit focused on converting compromised TP-Link, MikroTik, and camera devices into **SOCKS5 proxies** and reverse tunnels over port `4444`, relying on stolen access, weak credentials, and known vulnerabilities, including `CVE-2021-33044`. Hunt.io said the activity was not attributed to a named threat actor or state entity, but the exposed infrastructure pointed to a low-cost, repeatable campaign aimed at Ukrainian targets using publicly available tools and long-patched flaws.
Aug 13, 2026
A joint advisory from CISA, NSA, FBI and allied agencies warns that Russia’s GRU Unit 26165, known as **APT28, Fancy Bear and Forest Blizzard**, has conducted cyberespionage against dozens of Western government and private-sector organizations supporting aid to Ukraine since 2022. Targets include air, sea and rail transportation providers, logistics companies and related technology services. Operators gain access through password spraying, credential-harvesting and malware-delivery spearphishing, and exploitation of internet-facing infrastructure, including VPNs. Reported exploited vulnerabilities include Outlook’s NTLM credential leak (**CVE-2023-23397**), several Roundcube flaws and WinRAR’s **CVE-2023-38831**. Follow-on reporting also identifies exploitation of **CVE-2023-20273**. After compromise, operators steal credentials, conduct Active Directory reconnaissance, move laterally using Impacket, PsExec and RDP, and abuse Microsoft Exchange mailbox permissions for sustained email collection. They use legitimate utilities alongside malware such as **HEADLACE and MASEPIE**, clear event logs, and exfiltrate data through OpenSSH and email interfaces. The advisory links the campaign to targeting of more than **10,000 internet-connected cameras**, concentrated in Ukraine and neighboring countries, to monitor aid movements; that figure represents targeted cameras, not confirmed compromises. Defenders should prioritize patching exposed services, strong authentication, privileged-access restrictions and segmentation, while hunting for abnormal mailbox permissions, credential theft, lateral movement and log clearing across endpoint, cloud and network telemetry. Persistent access could enable future disruption, but the reporting does not establish confirmed sabotage.
Oct 9, 2026