DVR exploitation spikes in Ukraine as war activity intensifies

At a glance

What this is: GreyNoise tracked a short but concentrated surge of DVR exploitation attempts in Ukraine, centred on Hikvision devices and CVE-2021-36260.

Why it matters: For security teams, the case shows how exposed video infrastructure can become both a cyber target and a real-world surveillance asset when patching and exposure control lag.

By the numbers:

• GreyNoise saw a nine-day surge of exploitation attempts between 21 September and 1 October 2026.
• The activity centred on CVE-2021-36260, which allows unauthenticated command injection against unpatched Hikvision products.

Context

Digital video recorders and networked cameras are now part of the attack surface, not just operational equipment. When they remain exposed to the internet or are left unpatched, attackers can use them for remote access, environmental observation, or as stepping stones into broader operational technology and security environments.

The Ukraine activity matters because it links a common edge device class to wartime reconnaissance pressure. Even when a campaign is technically narrow, the governance problem is broader: organisations need visibility into where surveillance devices sit, whether they are patchable, and whether their exposure creates a physical security risk as well as a cyber one.

Key questions

Q: What breaks when internet-exposed DVRs are not patched or isolated?

A: They stop behaving like passive building equipment and become remotely exploitable endpoints. An unpatched, internet-reachable DVR can be used for command execution, reconnaissance, and physical observation. The failure is not only technical compromise. It is the loss of control over a device that can reveal site activity and support wider targeting.

Q: Why do exposed surveillance devices create more than cyber risk?

A: Because cameras and DVRs can reveal movement, layouts, response timing, and other information that is useful outside the network. When those devices are compromised, attackers may gain physical situational awareness as well as remote access. That makes them part of operational security and site-risk governance, not only IT asset management.

Q: What are the signs that DVR exploitation attempts are becoming targeted?

A: Look for a sudden increase from a low baseline, repeated requests against the same device family, and a small number of sources driving most of the traffic. That pattern suggests directed interest rather than random background scanning and should move the affected devices up the remediation queue.

Q: How should organisations reduce the attack surface of surveillance infrastructure?

A: Remove direct internet exposure wherever possible, place administrative access behind controlled paths, and segment video networks from business systems. Then maintain firmware visibility and decommission unsupported devices. The aim is to make compromise materially harder and to limit what a successful exploit can observe or reach.

Technical breakdown

Why DVRs are a reconnaissance target

Internet-exposed DVRs and IP cameras are attractive because they combine weak operational governance with persistent physical utility. They often sit outside central endpoint tooling, are patched irregularly, and may remain reachable long after their business purpose changes. In a conflict environment, the value is not only access to the device itself. A compromised camera can reveal movement, facility layout, perimeter activity, and response timing, turning a small foothold into useful situational awareness. The technical issue is not exotic exploitation, but the mismatch between embedded device management and modern exposure control.

Practical implication: inventory surveillance devices as part of your exposure management program, not as isolated building systems.

How unauthenticated command injection changes the risk model

CVE-2021-36260 is an unauthenticated command injection flaw, which means an attacker does not need valid credentials to execute commands on affected, unpatched Hikvision products. That matters because the control boundary is not identity verification but patch state and network reachability. Once an exposed device accepts attacker-supplied commands, the attacker can test access, probe the environment, or prepare for follow-on activity without first compromising a user account. In practice, this moves the problem from authentication failure to device hardening failure.

Practical implication: treat internet reachability on legacy video devices as an unacceptable precondition for exploitation, and remove it where possible.

Why repeated scanning signals operational intent

GreyNoise’s description of a near-zero baseline followed by a concentrated burst matters because it distinguishes opportunistic background noise from targeted reconnaissance or exploitation. Repeated requests from a small set of IPs can indicate campaign coordination, especially when the same template and the same device family are used over multiple days. The significance is not that every probe succeeds. It is that attackers can sustain pressure against a narrow target set until a vulnerable device, misconfiguration, or weak monitoring position appears.

Practical implication: alert on sudden changes in scan volume or source concentration against specific device families, not just on successful compromise.

Threat narrative

Attacker objective: The likely objective is to gain local visibility and command execution on exposed surveillance devices so the attacker can support reconnaissance and battlefield awareness.

1. Entry begins with internet-facing Hikvision DVR and camera targets that accept exploit traffic against CVE-2021-36260.
2. Credential access is not required because the flaw allows unauthenticated command injection on unpatched devices.
3. Escalation comes from command execution on a surveillance device that can expose live site information and support further reconnaissance.
4. Impact is the loss of physical situational awareness and the creation of a foothold that can support broader operational targeting.

NHI Mgmt Group analysis

Surveillance devices are now governance assets, not peripheral hardware. Once DVRs and cameras sit on the internet, they become part of the security boundary and should be governed accordingly. Their compromise can affect both cyber and physical risk, which means inventory, exposure reduction, and patch accountability matter as much as the device's operational role. Practitioners should treat video infrastructure as a managed access surface, not a facilities exception.

Command-injection exposure on edge devices is a lifecycle failure, not a one-off vulnerability event. CVE-2021-36260 matters because it shows how a single unpatched device family can remain exploitable across long periods of low activity and then reappear when threat conditions change. That is a lifecycle problem involving ownership, patch cadence, and decommissioning discipline. The governance lesson is that legacy embedded devices need the same accountability model as servers and endpoints.

Physical reconnaissance and cyber exploitation are converging in ways many programmes still under-model. In conflict zones especially, a compromised camera can support target observation before, during, and after strikes, which makes the security question operational rather than purely technical. This is where identity and access governance intersect with broader security: if the device is reachable, the attacker does not need human credentials to create real-world intelligence value. Practitioners should align embedded-device controls with site-risk management.

GreyNoise-style scan concentration is a useful signal for exposure management maturity. A sharp rise from a near-zero baseline, particularly from a narrow source set, should trigger review of reachability, patch status, and alerting coverage for the affected device family. The practical issue is not only exploitation likelihood but also whether the environment can distinguish background internet noise from targeted campaigns. Practitioners should use source concentration as a prioritisation cue for remediation and monitoring.

Edge-device compromise should be folded into zero-trust thinking, but not confused with it. Zero trust does not protect what is already publicly reachable and vulnerable. For DVRs and cameras, the first control is reducing unnecessary exposure, then enforcing segmentation and rapid patch governance. The broader lesson is that network design, device lifecycle management, and operational risk must be handled together rather than as separate teams' problems.

What this signals

Exposure management for embedded systems needs to be continuous, not periodic. DVRs and cameras often escape normal endpoint and vulnerability workflows, yet they can become high-value targets as soon as threat conditions change. Practitioners should maintain an always-current view of where these devices are exposed, which firmware they run, and which sites depend on them.

Device compromise and physical reconnaissance now belong in the same risk conversation. When surveillance infrastructure is reachable from the internet, the risk is not limited to remote exploitation. A compromised camera can support real-world observation, which means security teams should coordinate with physical security and site operations on segmentation, remote access, and response.

Reconnaissance spikes are useful prioritisation signals for security programmes. Sudden concentration against a narrow device family should push those assets ahead of routine maintenance queues, especially when patch support is uncertain. The practical challenge is not spotting every probe. It is deciding which exposure patterns demand immediate governance attention.

For practitioners

• Inventory exposed surveillance devices Build a current list of all internet-facing DVRs, NVRs, and IP cameras, including model, firmware, owner, and business location. Prioritise devices that support remote management or are reachable without VPN.
• Eliminate unnecessary public reachability Remove direct internet exposure for video systems where business operations do not require it. Place remote administration behind controlled access paths and segment camera networks from user and server networks.
• Patch and retire vulnerable Hikvision estates Track firmware versions for device families known to accept unauthenticated command injection and remove unsupported units from service. Where patching is delayed, treat the device as high-risk and compensate with isolation and monitoring.
• Alert on source concentration and scan bursts Tune monitoring to flag short, dense bursts of requests against a narrow device family, especially when they come from a small number of sources. Use that pattern to trigger manual review rather than relying only on successful exploit detection.

Key takeaways

• Exposed DVRs and cameras can become both cyber footholds and physical reconnaissance tools when patching and access controls lag.
• The Ukraine campaign shows how a low-baseline device family can shift quickly into a concentrated exploitation target during heightened operational pressure.
• Security teams should govern surveillance infrastructure as part of exposure management, segmentation, and lifecycle control, not as a facilities exception.

Key terms

• Internet-Exposed Surveillance Device: A camera, DVR, or NVR reachable from public networks rather than only from a controlled internal segment. These devices are often overlooked in enterprise inventory, which makes them attractive targets when attackers want remote access or physical situational awareness.
• Unauthenticated SQL Injection: An unauthenticated SQL injection is a flaw that lets an external attacker alter database queries without logging in. It usually appears where application code accepts user input and passes it into query-building logic without strict validation or parameterization.
• Reconnaissance And Exploitation: Reconnaissance and exploitation are distinct phases of attack or testing. Reconnaissance is about finding a path, while exploitation is about successfully using it, and they must be measured separately if a team wants meaningful security insight.
• Device Lifecycle Governance: Device lifecycle governance is the set of controls that cover provisioning, assignment, use, recovery, and retirement of shared endpoints. It matters because a device that is managed only at enrollment can still become risky if ownership, status, and decommissioning are not kept current.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners connect identity controls to the broader security decisions their programmes rely on.