DVR exploitation in Ukraine: what security teams need to watch

TL;DR: GreyNoise identified a nine-day surge of scanning and exploitation attempts against Hikvision DVR and camera targets in Ukraine between 21 September and 1 October 2026, with most activity tied to CVE-2021-36260 and three PureVPN exit nodes plus one domestic IP. The pattern raises operational concern around exposed surveillance infrastructure during conflict, where unauthenticated command injection can support physical reconnaissance as well as cyber intrusion.

Editorial analysis by NHI Mgmt Group, based on content published by GreyNoise: “Spike in Attacks Targeting Digital Video Recorders in Ukraine”.

By the numbers:

• GreyNoise saw a nine-day surge of exploitation attempts between 21 September and 1 October 2026.
• The activity centred on CVE-2021-36260, which allows unauthenticated command injection against unpatched Hikvision products.

Key questions

Q: What breaks when internet-exposed DVRs are not patched or isolated?

A: They stop behaving like passive building equipment and become remotely exploitable endpoints.

Q: Why do exposed surveillance devices create more than cyber risk?

A: Because cameras and DVRs can reveal movement, layouts, response timing, and other information that is useful outside the network.

Q: What are the signs that DVR exploitation attempts are becoming targeted?

A: Look for a sudden increase from a low baseline, repeated requests against the same device family, and a small number of sources driving most of the traffic.

Practitioner guidance

• Inventory exposed surveillance devices Build a current list of all internet-facing DVRs, NVRs, and IP cameras, including model, firmware, owner, and business location.
• Eliminate unnecessary public reachability Remove direct internet exposure for video systems where business operations do not require it.
• Patch and retire vulnerable Hikvision estates Track firmware versions for device families known to accept unauthenticated command injection and remove unsupported units from service.

Bottom line: Exposed DVRs and cameras can become both cyber footholds and physical reconnaissance tools when patching and access controls lag.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →