← Read the analysis
Observed exploitation attemptsTLP:CLEAR
Hikvision exploitation attempts in Ukraine: a nine-day surge
Attempts to exploit CVE-2021-36260 against Ukraine, recorded by GreyNoise: near zero for months, scanning from one of four IPs, a nine-day surge from all four, then a stop. It came during wartime, as Russian missile and drone strikes hit Ukraine. GreyNoise cannot say whether the two are connected.
6 dated events on 6 daysExploitation attempts↑ ↓ to step through
Sep 212026
Reconnaissance begins
One of the four IPs, on a Ukrainian network, sends connection attempts to service ports in Ukraine, with no exploit. GreyNoise rates its link to the others low confidence.
Dated from GreyNoise sessions, connection attempts with no request, from the IP on a Ukrainian network
Sep 22
Almost no attempts before the surge
Since early July, attempts at this exploit against Ukraine are rare, and none come from the four IPs.
Dated from GreyNoise sessions, Hikvision IP Camera RCE CVE-2021-36260 Attempt tag, aimed at Ukraine
Sep 23
Exploitation attempts
The surge begins
(Hikvision IP Camera RCE CVE-2021-36260 Attempt) Attempts against Ukraine jump from near zero. Across the surge, four IPs send almost all of them.
Dated from GreyNoise sessions, Hikvision IP Camera RCE CVE-2021-36260 Attempt tag, four IPs
Open in the GreyNoise Visualizer ↗Sep 27
Exploitation attempts
Attempts continue
Attempts continue, almost all from the four IPs. Every recorded request from the four is the same command test, with nothing to install.
Dated from GreyNoise sessions, Hikvision IP Camera RCE CVE-2021-36260 Attempt tag, four IPs
Oct 1
Exploitation attempts
The surge stops
GreyNoise records the last attempts from the four IPs.
Dated from GreyNoise sessions, Hikvision IP Camera RCE CVE-2021-36260 Attempt tag, four IPs
5 days with no dated recordOct 2–Oct 6
Oct 7
No attempts from the four since
GreyNoise has recorded no attempts from any of the four IPs since Oct 1.
Dated from GreyNoise sessions, Hikvision IP Camera RCE CVE-2021-36260 Attempt tag, four IPs, checked to Oct 7
Source: GreyNoise.
Dates are UTC days. The Ukrainian provider IP is not named here.
