Hundreds of Internet-Facing VNC Servers Expose ICS/OT

Why It Matters

The unchecked exposure of remote‑access endpoints creates a direct pathway for ransomware, nation‑state actors, and cybercriminals to infiltrate critical infrastructure, amplifying both operational risk and regulatory scrutiny.

Key Takeaways

• 1.8M RDP and 1.6M VNC servers exposed globally, mainly US and China
• 91K RDP and 29K VNC servers linked to specific industries
• 19K RDP servers vulnerable to BlueKeep, an unpatched Windows flaw
• 60K VNC servers lack authentication; 670 grant direct OT panel access
• Russia-linked groups exploit VNC/OT; Redheberg botnet hits 40K servers

Pulse Analysis

The proliferation of internet‑facing remote‑access services has become a silent crisis for both IT and operational technology environments. A recent Shodan sweep identified roughly 1.8 million RDP and 1.6 million VNC endpoints openly reachable, with the United States and China accounting for the bulk of the exposure. While many of these hosts belong to honeypots or hosting providers, Forescout’s deeper analysis uncovered 91 000 RDP and 29 000 VNC instances tied to retail, education, manufacturing, healthcare and other critical sectors. The sheer volume underscores a systemic neglect of basic network segmentation and secure gateway practices.

Beyond the sheer count, the quality of the exposure is alarming. Over 19 000 RDP servers still run legacy Windows versions susceptible to the BlueKeep vulnerability, a flaw that enables unauthenticated remote code execution and has been weaponized by ransomware gangs for years. Equally troubling, nearly 60 000 VNC installations lack any authentication, and 670 of those provide direct, unauthenticated access to industrial control system panels. Threat actors such as the Russia‑linked Infrastructure Destruction Squad have already demonstrated the value of these footholds, publishing videos of compromised SCADA devices and even marketing access to a Czechian system on underground forums.

Mitigating this attack surface requires a shift from convenience‑first remote tools to purpose‑built, zero‑trust access solutions. Enterprises should retire exposed RDP/VNC endpoints, enforce strict firewall rules, and deploy multi‑factor authentication or VPN gateways for any remote sessions. For OT environments, dedicated remote‑access platforms that isolate control networks and provide granular audit trails are essential. As regulators tighten requirements for critical infrastructure cybersecurity, organizations that proactively harden their remote‑access posture will not only reduce breach risk but also gain a competitive edge in a market increasingly driven by resilience and compliance.