Threat Intelligence Feed — Tag: VNC_AUTH_ATTEMPT

Romanian-based threat actor at 80.94.95.55 conducted extensive multi-protocol reconnaissance targeting RDP, ICS protocols, SSH, and VNC services over a 9-day period from March 29-April 7, 2026. The campaign generated 134,308 events with notable focus on industrial control systems (S7COMM protocol) a…

IP address 87.121.79.222 (Netherlands/AS213725) conducted extensive reconnaissance activity from March 30 to April 5, 2026, targeting SSH, VNC, and Kubernetes infrastructure with 1,569 recorded events across 14 unique ports. The campaign demonstrates systematic scanning behavior with particular focu…