Spike in Attacks Targeting Digital Video Recorders in Ukraine

An increase in scanning and exploitation attempts targeting Digital Video Recorders (DVRs) occurred in Ukraine between September 21 and October 1, 2026, coinciding with escalating Russian strikes across the country. Exploitation attempts focused on CVE-2021-36260 against unpatched Hikvision products, utilizing a template for remote command execution. These activities involved multiple IP addresses, including three PureVPN exit nodes and one domestic Ukrainian IP address. While exploitation attempts were noted during this period, GreyNoise observed near-zero activity against Ukraine in the preceding months from these specific IPs.

The synchronized surge in exploitation attempts against a specific vulnerability, tied temporally to an active conflict zone, suggests a potential coordinated campaign leveraging known, high-impact flaws within critical infrastructure devices. The involvement of VPN exit nodes alongside a domestic IP complicates attribution, suggesting a layered approach designed to obscure the origin and exploit chain. The observation that the scanning activity in this specific context was previously absent indicates a shift from reconnaissance to active exploitation driven by immediate operational necessity—the need for battlefield awareness. This highlights how abstract vulnerabilities can be weaponized when geopolitical stress amplifies the perceived risk of physical access or intelligence gathering. The uncertainty regarding the connection between the observed cyber activity and kinetic strikes leaves open questions about the intersection of cyber warfare and physical conflict, demanding inquiry into the relationship between digital surveillance capabilities and kinetic action. What other types of vulnerabilities are being prioritized in environments experiencing acute conflict? How does the classification of exploitation attempts versus simple reconnaissance affect the response required from defenders?