Hackers Target Hikvision Cameras in Ukraine With RCE Exploits Amid Russian Airstrikes

GreyNoise documented a nine-day spike (Sep 23–Oct 1, 2026) in attempted remote command execution against Hikvision devices exploiting CVE-2021-36260 (CVSS 9.8). Most observed traffic originated from three PureVPN exit IPs and one Ukrainian network address; GreyNoise recorded repeated command-test requests but no confirmed compromises, and could not establish a direct connection to concurrent Russian missile/drone strikes. Firmware updates and vendor-recommended remediation are advised for affected Hikvision deployments.