Cyble Sees Rise In VNC Exploitation Attempts

This Cyble intelligence brief documents thousands of internet-exposed VNC instances (many unauthenticated) including connections to ICS/SCADA/HMI systems in critical infrastructure, reports a spike in attacks and scans against port 5900, cites at least one observed account of unauthorized access, and shows criminal marketplaces trading access — warning of high-risk outcomes (ransomware, operational disruption) and providing hardening recommendations.