Forescout's analysis revealed approximately 1.8 million RDP and 1.6 million VNC servers exposed to the internet, with tens of thousands linked to specific industries such as retail, education, manufacturing, and healthcare. Notably, 670 VNC servers provide direct unauthenticated access to ICS/OT panels. Many exposed servers run end-of-life Windows versions, and over 19,000 RDP servers remain vulnerable to the BlueKeep vulnerability. Threat actors, including Russia-linked groups Infrastructure Destruction Squad and Dark Engine, have actively targeted these exposed systems, using tools to scan and compromise OT environments. Additionally, the Redheberg botnet has infected nearly 40,000 exposed VNC servers. These findings highlight the risks of exposing remote access protocols directly to the internet without secure gateways or authentication.

Exposed RDP and VNC servers increase the risk of unauthorized access to sensitive industrial control and operational technology systems. Vulnerabilities such as BlueKeep on RDP servers and lack of authentication on many VNC servers facilitate potential compromise. Access to ICS/OT systems can enable attackers to disrupt critical infrastructure operations. The active targeting by nation-state affiliated groups and cybercriminals for ransomware deployment and botnet infections demonstrates real-world exploitation potential. The exposure of unsupported Windows systems further exacerbates the risk due to unpatched vulnerabilities.

Organizations should avoid exposing RDP and VNC servers directly to the internet. Instead, they should implement dedicated secure remote access solutions designed for sensitive cyber-physical systems. Enabling strong authentication on all remote access services is critical. Systems running end-of-life or unsupported Windows versions should be upgraded or isolated to reduce vulnerability exposure. Monitoring for unauthorized access attempts and applying vendor security advisories related to remote access protocols is recommended. Since no official patch or vendor advisory is provided here, patch status is not yet confirmed — check vendor advisories for current remediation guidance.