Hackers Hijacking VNC Connections to Gain Access to OT Control Devices in Critical Infrastructure

A joint U.S. and international advisory warns that pro‑Russia hacktivist groups (CARR, NoName057(16), Z‑Pentest, Sector16) are actively exploiting internet‑exposed VNC connections to infiltrate OT HMIs in water, food/agriculture, and energy sectors; attackers use straightforward scanning and brute‑force against port 5900, manipulate GUIs to cause “loss of view,” and post proof for publicity. The advisory documents TTPs and impacts, cites an April 2025 case combining DDoS and SCADA access, and urges immediate mitigations—remove internet‑exposed OT, segment IT/OT, enforce MFA, eliminate default credentials, audit firewalls, enable view‑only modes, and follow incident‑response playbooks.