Key Takeaways
- Approximately 1.8 million RDP and 1.6 million VNC servers are publicly exposed on the internet, with the majority located in China and the United States.
- Forescout’s analysis identified roughly 91,000 RDP and 29,000 VNC servers that can be tied to specific industries, many of them in retail, education, services, manufacturing, and healthcare.
- A significant portion of these servers runs outdated, unsupported Windows versions; over 19,000 RDP systems are vulnerable to the BlueKeep flaw, and nearly 60,000 VNC servers lack authentication, including 670 that grant direct, unauthenticated access to industrial control/operational technology (ICS/OT) panels.
- Real‑world threats have already materialized: Russia‑linked groups have published tools to scan for RDP/VNC/OT protocols, demonstrated compromise of a groundwater pumping station in Israel, a control system in Turkey, and advertised sale of access to a SCADA system in Czechia.
- Profit‑driven cybercriminals exploit exposed RDP for ransomware deployment, while the Redheberg botnet has infected close to 40,000 vulnerable VNC servers since February.
- Mitigation requires moving away from direct internet exposure of RDP/VNC, employing dedicated secure remote‑access gateways, enforcing strong authentication, patching legacy systems, and segmenting OT networks from corporate IT.
Overview of Exposed Remote Access Servers
Forescout’s research reveals that roughly 1.8 million Remote Desktop Protocol (RDP) servers and 1.6 million Virtual Network Computing (VNC) servers are reachable from the open internet. A Shodan‑based scan shows the bulk of these systems reside in China and the United States. While many of the hits correspond to honeypots, internet‑service providers, and hosting facilities, a non‑trivial subset—about 91,000 RDP and 29,000 VNC instances—can be linked to identifiable industry sectors. This exposure presents a substantial attack surface because RDP and VNC are designed for trusted, internal use; exposing them directly to the internet bypasses many built‑in safeguards and invites unauthorized intrusion.
Sector Distribution and Aging Infrastructure
The exposed servers are not evenly distributed across industries. Forescout found a notable concentration in retail, education, services, manufacturing, and healthcare organizations. Moreover, a significant proportion of these systems runs Windows releases that have reached end‑of‑life or end‑of‑support, meaning they no longer receive security patches from Microsoft. Over 19,000 of the exposed RDP servers are specifically vulnerable to CVE‑2019‑0708, commonly known as BlueKeep—a wormable flaw that has been leveraged by multiple threat‑actor groups for lateral movement and payload delivery. The prevalence of outdated, unsupported OS versions amplifies risk, as defenders cannot rely on vendor‑provided mitigations for these hosts.
Critical Vulnerabilities and Direct OT Access
Beyond BlueKeep, Forescout’s analysis uncovered that nearly 60,000 VNC servers lack any form of authentication, allowing anyone who can reach the IP address to connect without credentials. Among these unauthenticated VNC hosts, 670 provide direct, unprotected access to industrial control system (ICS) or operational technology (OT) panels. Such panels often manage critical processes like power generation, water treatment, manufacturing lines, or building automation. Unauthenticated OT access is especially alarming because it enables attackers to manipulate physical processes, potentially causing safety hazards, environmental damage, or service disruptions without needing to bypass additional security layers.
Observed Threat Activity and Real‑World Incidents
The theoretical danger has already manifested in several observed campaigns. In December 2025, government agencies warned that Russia‑linked adversaries have been targeting OT infrastructure via VNC. More recently, a group identified as the Infrastructure Destruction Squad (IDS) / Dark Engine released a scanning tool designed to locate RDP, VNC, and OT‑specific protocols exposed on the internet. On February 23, the group posted a video purporting to show a compromised groundwater pumping station in Israel discovered with this tool. On March 9, they shared another demonstration where the tool was run against a target set that included a VNC screenshot of a control system in Turkey. Between these posts, the group also advertised the sale of access to an exposed SCADA system in Czechia, indicating a profit‑motive alongside geopolitical objectives.
Criminal Exploitation and Botnet Activity
State‑aligned actors are not the only threat actors exploiting these exposures. Profit‑driven cybercriminals have long abused open RDP endpoints as an initial foothold for ransomware campaigns, leveraging the protocol’s ability to execute remote code and distribute malware across networks. Simultaneously, the Redheberg botnet—identified by security researchers in early 2026—has infected close to 40,000 vulnerable VNC servers since February. The botnet uses the compromised VNC interfaces to propagate, harvest credentials, and launch distributed denial‑of‑service (DDoS) attacks or further malware drops. This dual‑track threat landscape underscores that both nation‑state and criminal actors view exposed remote‑access services as high‑value targets.
Mitigation Strategies and Recommendations
To reduce risk, organizations should eliminate direct internet exposure of RDP and VNC wherever possible. Where remote access remains necessary, it should be terminated behind a hardened gateway—such as a VPN with multi‑factor authentication, a Zero Trust Network Access (ZTNA) solution, or a purpose‑built privileged access management (PAM) platform that enforces strict session controls and logging. Legacy Windows systems must be upgraded or isolated; if patching is infeasible, network segmentation and host‑based firewalls should restrict RDP/VNC traffic to known management subnets. Authentication must be enforced on all VNC services, preferably using strong passwords or certificate‑based methods, and unused services should be disabled. Continuous monitoring for anomalous login attempts, coupled with threat‑intelligence feeds that flag known malicious scanners (e.g., the IDS/Dark Engine tool), can help detect compromise early. Finally, OT/ICS environments should be segregated from corporate IT networks, with strict firewalls and unidirectional gateways where feasible, ensuring that even if a remote‑access server is breached, the attacker cannot pivot to critical physical processes. By adopting these controls, organizations can dramatically shrink the attack surface posed by the millions of exposed RDP and VNC services identified in Forescout’s study.