Spike in Attacks Targeting Digital Video Recorders in Ukraine

Spike in Attacks Targeting Digital Video Recorders in Ukraine GreyNoise October 8, 2026 GreyNoise identified an increase in scanning and exploitation attempts targeting Digital Video Recorders (DVR) in Ukraine between 21 September and 1 October 2026. The activity coincides with an escalation in Russian strikes across the country. There are a myriad of malicious use cases for compromising DVRs; one involves gaining the ability to physically survey an area to gain battlespace awareness before, during, and after kinetic strikes. Observed exploitation attemptsTLP:CLEAR Hikvision exploitation attempts in Ukraine: a nine-day surge Attempts to exploit CVE-2021-36260 against Ukraine, recorded by GreyNoise: near zero for months, scanning from one of four IPs, a nine-day surge from all four, then a stop. It came during wartime, as Russian missile and drone strikes hit Ukraine. GreyNoise cannot say whether the two are connected. 6 dated events on 6 daysExploitation attemptsSelect a date to read it. 5 days Sep 21, 2026Sep 28Oct 7, 2026 Sep 21, 2026 Reconnaissance begins One of the four IPs, on a Ukrainian network, sends connection attempts to service ports in Ukraine, with no exploit. GreyNoise rates its link to the others low confidence. Dates are UTC days. The Ukrainian provider IP is not named here. The majority of related activity GreyNoise observed focused on exploitation of CVE-2021-36260, which allows unauthenticated command injection against unpatched Hikvision products. The actors used the Hikvision IP camera/NVR - Remote Command Execution nuclei template. The activity involved three PureVPN exit nodes and one Ukrainian domestic IP address. GreyNoise assesses the PureVPN-associated activity is attributable to a single entity; the activity from the domestic UA IP is possibly related (low confidence). GreyNoise did generally observe a spike in detection of exploitation and scanning attempts against CVE-2021-36260 globally; however, the four IP addresses did not attempt to exploit any of our sensors outside of Ukraine. GreyNoise observed almost no activity like this against Ukraine in the months prior, and none from these four IPs. Indicators PureVPN is a commercial virtual private network provider; activity from these exit nodes may not be related due to legitimate shared use.