Surge in Remote‑Code Exploits Hits Hikvision Cameras Across Ukraine During Russian Airstrikes

Security researchers observed a sharp uptick in remote‑code execution (RCE) attempts against Hikvision surveillance cameras in Ukraine that coincided with a wave of Russian missile and drone attacks. The activity, recorded over a nine‑day span from September 23 to October 1, suggests a coordinated effort to compromise visual monitoring infrastructure while kinetic operations were underway.

GreyNoise, a platform that aggregates internet‑wide scanning data, reported a sustained increase in exploitation traffic targeting the Chinese‑made devices. The probes focused on known vulnerabilities that allow an attacker to run arbitrary commands on the camera firmware, potentially giving them full control of video streams and the ability to manipulate or disable the equipment.

The timing aligns with the broader cyber‑warfare landscape that has unfolded since Russia's invasion of Ukraine in 2022. Both sides have repeatedly leveraged digital tools to complement physical attacks, and surveillance systems have become a recurring target because they provide real‑time situational awareness to civilian authorities and defense forces.

Hikvision cameras are widely deployed in public spaces, transportation hubs, and critical infrastructure, making them attractive to adversaries seeking low‑cost, high‑impact footholds. Several high‑severity vulnerabilities in the brand’s firmware have been disclosed in recent years, many of which enable remote code execution without requiring authentication. Exploit kits that automate the scanning and payload delivery process can quickly scan large address spaces, increasing the odds of finding vulnerable units.

Ukrainian officials and private operators have been urged to apply available patches, isolate vulnerable devices on segmented networks, and monitor for anomalous traffic. Cyber‑security firms say the observed surge is likely a prelude to further intrusions, especially as the conflict intensifies. Ongoing monitoring by threat‑intelligence services will be crucial to detect subsequent campaigns and to mitigate the risk of compromised cameras being used for espionage or sabotage.