Forescout Finds 670 Unauthenticated VNC Servers Exposing ICS/OT Panels
Summary
Forescout found 670 unauthenticated VNC servers offering direct access to ICS/OT panels, alongside widespread exposed RDP and VNC servers. The firm recommends secure remote-access solutions for sensitive systems.
Key points
- Forescout linked 91,000 exposed RDP servers and 29,000 exposed VNC servers to specific industries.
- Nearly 60,000 exposed VNC servers lacked authentication; 670 provided direct access to ICS/OT panels.
- More than 19,000 exposed RDP servers were vulnerable to BlueKeep, an older flaw exploited by threat actors.
- Forescout cited Russian-linked activity involving VNC and OT systems; the group Infrastructure Destruction Squad, also known as Dark Engine, shared a scanning tool and claimed examples of access.
- The firm said the Redheberg botnet had infected nearly 40,000 exposed VNC servers since February.
- Forescout recommends using dedicated secure remote-access solutions, including solutions designed for sensitive cyber-physical systems.
Article Details
- Event Type
- Research findings on internet-exposed RDP and VNC servers, including unauthenticated access to ICS/OT systems
- Impact
- Forescout researchers identified 670 unauthenticated VNC servers providing direct access to ICS/OT panels and nearly 60,000 VNC servers without authentication. More than 19,000 exposed RDP servers were reported vulnerable to BlueKeep. The article says the Redheberg botnet has infected nearly 40,000 exposed VNC servers since February. Infrastructure Destruction Squad said it found a groundwater pumping station in Israel and showed a control-system screenshot in Turkey; Forescout described the first as purportedly compromised. The findings indicate potential access to cyber-physical systems, but do not establish that all exposed systems were compromised.
Threat Actors
Infrastructure Destruction SquadThe article reports that this Russia-linked group shared a tool designed to scan for RDP, VNC, and OT-specific protocols, and said it found a groundwater pumping station in Israel. Forescout described the station as purportedly compromised. The article also reports the group advertised access to an exposed SCADA system in Czechia. It is also known as IDS and Dark Engine.RedhebergThe article reports that the Redheberg botnet has infected nearly 40,000 exposed VNC servers since February.
Malware
Tools
Countries
ChinaA Shodan search shows roughly 1.8 million RDP and 1.6 million VNC servers exposed on the internet, a majority in China and the United States.Czechia“Between these two posts, the group also advertised the sale of access to an exposed SCADA system in Czechia.”Israel“On February 23, the group shared a video of a purportedly compromised groundwater pumping station in Israel that it said was found with this tool.Turkeyof the tool being run against a specific target set, including a VNC screenshot of a control system in Turkey,” Forescout said, adding, “Between these two posts, the group also advertised the sale of access to anUnited StatesA Shodan search shows roughly 1.8 million RDP and 1.6 million VNC servers exposed on the internet, a majority in China and the United States.
Industries
EducationA significant percentage of exposed servers is hosted by organizations in the retail, education, services, manufacturing, and healthcare sectors.HealthcareA significant percentage of exposed servers is hosted by organizations in the retail, education, services, manufacturing, and healthcare sectors.ManufacturingA significant percentage of exposed servers is hosted by organizations in the retail, education, services, manufacturing, and healthcare sectors.RetailA significant percentage of exposed servers is hosted by organizations in the retail, education, services, manufacturing, and healthcare sectors.ServicesA significant percentage of exposed servers is hosted by organizations in the retail, education, services, manufacturing, and healthcare sectors.