Increased Exploitation of Hikvision DVRs in Ukraine Amid Escalating Conflict
ID: a73805b4-7be3-55c4-9370-bf81b7062896
STIX ID: report--a73805b4-7be3-55c4-9370-bf81b7062896
Feed Name: ThreatCluster
Threat Score
Between 21 Sept and 1 Oct 2026, there was a marked increase in scanning and exploitation attempts against unpatched Hikvision DVRs in Ukraine exploiting CVE-2021-36260 (CVSS 9.8). GreyNoise observed use of a Nuclei remote command execution template; traffic was traced to three PureVPN exit nodes and one Ukrainian IP, suggesting a potentially coordinated campaign aligned with regional military activity. Monitoring and patching of vulnerable DVRs is recommended.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.