# Pro-Russia hacktivists target critical infrastructure via exposed VNC

Published: 2025-12-18 · Severity: routine · Sectors: energy, government-national, infrastructure, manufacturing, transportation, healthcare
Canonical: https://vorant.io/reports/0d03a9d9-6c06-5873-8339-b6b2e33de8f9/pro-russia-hacktivists-target-critical-infrastructure-via-exposed-vnc

> Pro-Russia hacktivist groups exploit internet-exposed VNC devices to intrude on OT systems in water, food, energy sectors.

A joint advisory from CISA, FBI, NSA, and international partners documents coordinated opportunistic attacks by pro-Russia hacktivist groups—Cyber Army of Russia Reborn (CARR), NoName057(16), Z-Pentest, and Sector16—against critical infrastructure worldwide. These groups conduct unsophisticated but damaging intrusions using basic reconnaissance and brute-force techniques against internet-facing virtual network computing (VNC) connections to human-machine interface (HMI) devices in operational technology networks. The attackers scan for open VNC ports (default 5900, sometimes 5901-5910), identify devices with weak or default credentials, and use VNC software to gain access and manipulate control systems. While the groups lack advanced technical sophistication and sector-specific expertise, they have caused real operational impact including temporary loss of visibility, physical damage, and substantial remediation costs. Targeted sectors include water and wastewater systems, food and agriculture, and energy infrastructure. The advisory emphasizes that despite exaggerated claims of impact, these actors represent a persistent threat to vulnerable critical infrastructure and recommends immediate mitigation of internet-exposed OT assets, network segmentation, robust authentication, and monitoring.

## Mentioned in this report

- Threat actors: Cyber Army of Russia Reborn, NoName057(16), Sector16, Z-Pentest

## Detection guidance (public sample)

### Inbound VNC Connection to Windows Host from Public IP Address

ATT&CK: T1021.005

Detects inbound network connections to default VNC ports 5900-5910 from non-private source addresses, matching the internet-exposed VNC access used against HMI and OT hosts. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Inbound VNC Connection to Windows Host from Public IP Address
description: Detects inbound connections to the default VNC ports 5900-5910 from non-RFC1918
  source addresses on Windows hosts (for example HMI or SCADA workstations). Pro-Russia
  hacktivists scan for exposed VNC and then log in with default or weak credentials.
  A burst of connections from one source to several hosts or ports suggests scanning
  or spraying.
tags:
- attack.lateral-movement
- attack.t1021.005
- attack.initial-access
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: 'false'
    DestinationPort:
    - 5900
    - 5901
    - 5902
    - 5903
    - 5904
    - 5905
    - 5906
    - 5907
    - 5908
    - 5909
    - 5910
  filter_private:
    SourceIp|cidr:
    - 10.0.0.0/8
    - 172.16.0.0/12
    - 192.168.0.0/16
    - 127.0.0.0/8
    - 169.254.0.0/16
    - ::1/128
    - fe80::/10
    - fc00::/7
  condition: selection and not filter_private
falsepositives:
- Authorised vendor or integrator remote support over VNC from a known public address
- Internal security scanners that use public NAT addresses
level: medium
id: c8366441-cc42-56c9-9ae4-c5a34bb60376
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-343a
```

### Firewall Rule Added Opening Default VNC Port via Netsh

ATT&CK: T1021.005

Detects netsh adding a firewall rule or port opening for VNC ports 5900-5910, which exposes a VNC service on the host. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Firewall Rule Added Opening Default VNC Port via Netsh
description: Detects netsh.exe creating an allow rule or port opening for the default
  VNC ports 5900-5910. Exposing VNC on HMI or OT hosts enables the internet-facing
  access abused by hacktivist groups.
tags:
- attack.lateral-movement
- attack.t1021.005
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith: \netsh.exe
  selection_action:
    CommandLine|contains:
    - add rule
    - portopening
  selection_port:
    CommandLine|re: (localport=|portopening\s+(tcp|udp)\s+)59(0[0-9]|10)
  condition: all of selection_*
falsepositives:
- Administrators deliberately enabling VNC for internal remote management
- Software deployment scripts installing a VNC server and its firewall exception
level: medium
id: c33290ca-62bb-55ad-8872-a278c9681329
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-343a
```

### VNC Server Executed from User-Writable or Non-Standard Path

ATT&CK: T1021.005

Detects common VNC server binaries running from temp, user profile, or public directories rather than a standard install location, suggesting unauthorised remote access setup. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: VNC Server Executed from User-Writable or Non-Standard Path
description: Detects well-known VNC server executables (UltraVNC, TightVNC, RealVNC,
  x11vnc-style) launched from user-writable locations such as Temp, AppData, ProgramData,
  Users\Public or Downloads. This may indicate unapproved VNC deployment for remote
  GUI control of OT or HMI systems.
tags:
- attack.lateral-movement
- attack.t1021.005
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
    - \winvnc.exe
    - \tvnserver.exe
    - \vncserver.exe
    - \winvnc4.exe
    - \x11vnc.exe
  selection_path:
    Image|contains:
    - \Temp\
    - \AppData\
    - \ProgramData\
    - \Users\Public\
    - \Downloads\
  condition: all of selection_*
falsepositives:
- Portable VNC server used by IT support staff for ad hoc assistance
- Vendor remote support tools that unpack a VNC server into a temp folder
level: medium
id: bff54cab-90db-5bd1-b027-0aea2a7e7127
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-343a
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-343a

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/0d03a9d9-6c06-5873-8339-b6b2e33de8f9/pro-russia-hacktivists-target-critical-infrastructure-via-exposed-vnc.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup