Hackers revive old Hikvision camera trick in spy campaign
Hackers weaponize old Hikvision camera exploits.
By Shutterstock
Follow us
- Attackers are exploiting an old Hikvision flaw to scan for vulnerable cameras and run code remotely.
- GreyNoise says the activity targeted Hikvision cameras and recorders in Ukraine during a nine-day period.
- Researchers found scans from four IP addresses but cannot confirm any camera compromises.
- Unpatched internet-connected cameras remain targets for criminals and state-linked spying campaigns.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
Attackers are exploiting a 5-year-old security flaw in Hikvision surveillance equipment in a fresh wave of attempted scanning and remote code execution attacks.
The flaw allows attackers to scan the internet for vulnerable devices and then run their own code on them remotely – potentially giving them full control of the camera or system.
The hackers targeted Hikvision cameras and digital video recorders (DVRs) in Ukraine between September 2nd and October 1st, according to researchers at GreyNoise.
The researchers note that the 9-day exploitation attempt coincided with an escalation of Russian missile and drone strikes on the territory.
The campaign primarily targeted CVE-2021-36260, a critical command injection flaw first disclosed in 2021 that allows unauthenticated attackers to remotely execute commands on unpatched Hikvision devices.
Attackers used a vulnerability scanner
According to GreyNoise, the attackers used a ready-made template for Nuclei, an open-source vulnerability scanner that automates checks for security flaws. This tool made it easier for them to find and target Hikvision devices still exposed to the flaw.
The attacks came from 4 IP addresses, including 3 linked to PureVPN that GreyNoise believes were being used by the same attacker or group, and a 4th on a Ukrainian network whose connection is less certain.
Researchers do not know whether targeted cameras were successfully compromised and say they can’t establish a direct connection between the exploitation attempts and kinetic attacks.
It came during wartime, as Russian missile and drone strikes hit Ukraine. We cannot say whether the 2 are connected,writes GreyNoise its analysis of the attempted camera exploits.
“Zombie tech” and old cameras weaponized
However, flaws in aging unpatched internet-connected devices – sometimes referred to as “Zombie Tech” are a global problem.
Earlier this year, SonicWall detected more than 67 million attempted attacks targeting Hikvision cameras across UK networks in 2025. The attacks accounted for around 20% of all medium and high-severity attacks.
Internet-connected cameras have also become key targets in modern warfare.
Israel reportedly hacked Iran's traffic camera networks for years to spy on Ayatollah Khamenei and other officials before his assassination in February’s US-Israel strikes.
"We knew Tehran like we know Jerusalem," one Israeli intelligence official said.
Other countries have also hacked into Israeli CCTV cameras – in Jerusalem last year, it was reported that Iran was using private security cameras in Israel to gather real-time intelligence.
