Pro-Russia hacktivists target critical infrastructure via exposed VNC
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Pro-Russia hacktivist groups exploit internet-exposed VNC devices to intrude on OT systems in water, food, energy sectors.
A joint advisory from CISA, FBI, NSA, and international partners documents coordinated opportunistic attacks by pro-Russia hacktivist groups—Cyber Army of Russia Reborn (CARR), NoName057(16), Z-Pentest, and Sector16—against critical infrastructure worldwide. These groups conduct unsophisticated but damaging intrusions using basic reconnaissance and brute-force techniques against internet-facing virtual network computing (VNC) connections to human-machine interface (HMI) devices in operational technology networks. The attackers scan for open VNC ports (default 5900, sometimes 5901-5910), identify devices with weak or default credentials, and use VNC software to gain access and manipulate control systems. While the groups lack advanced technical sophistication and sector-specific expertise, they have caused real operational impact including temporary loss of visibility, physical damage, and substantial remediation costs. Targeted sectors include water and wastewater systems, food and agriculture, and energy infrastructure. The advisory emphasizes that despite exaggerated claims of impact, these actors represent a persistent threat to vulnerable critical infrastructure and recommends immediate mitigation of internet-exposed OT assets, network segmentation, robust authentication, and monitoring.
Mentioned in this report
Detection guidance
Inbound VNC Connection to Windows Host from Public IP Address
Detects inbound network connections to default VNC ports 5900-5910 from non-private source addresses, matching the internet-exposed VNC access used against HMI and OT hosts. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Inbound VNC Connection to Windows Host from Public IP Address
description: Detects inbound connections to the default VNC ports 5900-5910 from non-RFC1918
source addresses on Windows hosts (for example HMI or SCADA workstations). Pro-Russia
hacktivists scan for exposed VNC and then log in with default or weak credentials.
A burst of connections from one source to several hosts or ports suggests scanning
or spraying.
tags:
- attack.lateral-movement
- attack.t1021.005
- attack.initial-access
logsource:
category: network_connection
product: windows
detection:
selection:
Initiated: 'false'
DestinationPort:
- 5900
- 5901
- 5902
- 5903
- 5904
- 5905
- 5906
- 5907
- 5908
- 5909
- 5910
filter_private:
SourceIp|cidr:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
- 127.0.0.0/8
- 169.254.0.0/16
- ::1/128
- fe80::/10
- fc00::/7
condition: selection and not filter_private
falsepositives:
- Authorised vendor or integrator remote support over VNC from a known public address
- Internal security scanners that use public NAT addresses
level: medium
id: c8366441-cc42-56c9-9ae4-c5a34bb60376
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-343a
Firewall Rule Added Opening Default VNC Port via Netsh
Detects netsh adding a firewall rule or port opening for VNC ports 5900-5910, which exposes a VNC service on the host. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Firewall Rule Added Opening Default VNC Port via Netsh
description: Detects netsh.exe creating an allow rule or port opening for the default
VNC ports 5900-5910. Exposing VNC on HMI or OT hosts enables the internet-facing
access abused by hacktivist groups.
tags:
- attack.lateral-movement
- attack.t1021.005
logsource:
category: process_creation
product: windows
detection:
selection_img:
Image|endswith: \netsh.exe
selection_action:
CommandLine|contains:
- add rule
- portopening
selection_port:
CommandLine|re: (localport=|portopening\s+(tcp|udp)\s+)59(0[0-9]|10)
condition: all of selection_*
falsepositives:
- Administrators deliberately enabling VNC for internal remote management
- Software deployment scripts installing a VNC server and its firewall exception
level: medium
id: c33290ca-62bb-55ad-8872-a278c9681329
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-343a
VNC Server Executed from User-Writable or Non-Standard Path
Detects common VNC server binaries running from temp, user profile, or public directories rather than a standard install location, suggesting unauthorised remote access setup. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: VNC Server Executed from User-Writable or Non-Standard Path
description: Detects well-known VNC server executables (UltraVNC, TightVNC, RealVNC,
x11vnc-style) launched from user-writable locations such as Temp, AppData, ProgramData,
Users\Public or Downloads. This may indicate unapproved VNC deployment for remote
GUI control of OT or HMI systems.
tags:
- attack.lateral-movement
- attack.t1021.005
logsource:
category: process_creation
product: windows
detection:
selection_img:
Image|endswith:
- \winvnc.exe
- \tvnserver.exe
- \vncserver.exe
- \winvnc4.exe
- \x11vnc.exe
selection_path:
Image|contains:
- \Temp\
- \AppData\
- \ProgramData\
- \Users\Public\
- \Downloads\
condition: all of selection_*
falsepositives:
- Portable VNC server used by IT support staff for ad hoc assistance
- Vendor remote support tools that unpack a VNC server into a temp folder
level: medium
id: bff54cab-90db-5bd1-b027-0aea2a7e7127
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-343a
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-343a
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 614 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs