NewsPublished 29 Apr 2026

Hundreds of Internet-Facing VNC Servers Expose ICS/OT

Source SecurityWeek

Description

Forescout has identified tens of thousands of exposed RDP and VNC servers that can be mapped to specific industries. The post Hundreds of Internet-Facing VNC Servers Expose ICS/OT appeared first on SecurityWeek .

Impact

Exposed RDP and VNC servers increase the risk of unauthorized access to sensitive industrial control and operational technology systems. Vulnerabilities such as BlueKeep on RDP servers and lack of authentication on many VNC servers facilitate potential compromise. Access to ICS/OT systems can enable attackers to disrupt critical infrastructure operations. The active targeting by nation-state affiliated groups and cybercriminals for ransomware deployment and botnet infections demonstrates real-world exploitation potential. The exposure of unsupported Windows systems further exacerbates the risk due to unpatched vulnerabilities.

Defensive guidance

Organizations should avoid exposing RDP and VNC servers directly to the internet. Instead, they should implement dedicated secure remote access solutions designed for sensitive cyber-physical systems. Enabling strong authentication on all remote access services is critical. Systems running end-of-life or unsupported Windows versions should be upgraded or isolated to reduce vulnerability exposure. Monitoring for unauthorized access attempts and applying vendor security advisories related to remote access protocols is recommended.

Summary

Forescout's analysis revealed approximately 1.8 million RDP and 1.6 million VNC servers exposed to the internet, with tens of thousands linked to specific industries such as retail, education, manufacturing, and healthcare. Notably, 670 VNC servers provide direct unauthenticated access to ICS/OT panels. Many exposed servers run end-of-life Windows versions, and over 19,000 RDP servers remain vulnerable to the BlueKeep vulnerability. Threat actors, including Russia-linked groups Infrastructure Destruction Squad and Dark Engine, have actively targeted these exposed systems, using tools to scan and compromise OT environments. Additionally, the Redheberg botnet has infected nearly 40,000 exposed VNC servers. These findings highlight the risks of exposing remote access protocols directly to the internet without secure gateways or authentication.

References

securityweek.com/hundreds-of-internet-facing-vnc-servers-expose-ics-ot/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 29 Apr 2026, 12:06 UTC

References

Community reviews