Group-IB published a report on 11 November 2026 describing an open directory on a server in Latvia that exposed the working files of an operator it tracks as DarkLunnen. The files cover more than 14 months of attacks aimed at Europe. Group-IB has not linked DarkLunnen to any country or to a known threat group. The finding that matters for plant owners is a large Virtual Network Computing (VNC) password-guessing campaign against services on TCP port 5900, mostly at Ukrainian and Polish addresses, that reached human-machine interface (HMI) panels.
Group-IB researchers came across the directory in late July 2026 at the address 46[.]8[.]236[.]121, on port 8090. A simple web server had exposed the operator's working files, including tools, target lists, stolen device configurations and command history. The operator appeared to be active the same day the directory was found. Researchers recovered 35 of 457 files, about 3.1 gigabytes, before the directory went offline.
One recovered file lists 5,775 VNC endpoints the operator recorded as successfully logged in, mostly in Ukrainian and Polish address ranges. A separate 945-entry log records the desktop name each VNC server returned. About a quarter of those entries used names associated with HMI or industrial control system (ICS) equipment: about 180 "HMI WebServer" names, Weintek cMT-series panels and B&R visualization projects. The rest were ordinary Linux and Windows hosts and hypervisor consoles. VNC sends the desktop name only after a successful login, so the named entries were most likely real logins. Of the 945 entries, 28 used the password Admin@1980, a common dictionary password. Some hosts appear more than once, so the number of unique devices is probably lower than 945. Group-IB found no evidence that any industrial process was changed.
The same files also show a campaign against FortiGate firewalls using CVE-2024-55591, an authentication bypass in FortiOS and FortiProxy. A modified script was written to create a backdoor super-admin account named "service". The operator identified about 600 vulnerable devices in Turkey, 16 in Ukraine, 14 in Azerbaijan and 1 in Algeria. A stolen FortiGate configuration from a Romanian organization contained the same "service" account, and the operator extracted 10 cleartext virtual private network (VPN) passwords from that file.
The operator also scanned 12,183 addresses for Hikvision cameras vulnerable to CVE-2017-7921, an authentication bypass, and marked eight as vulnerable. Group-IB's detailed write-up describes the recovered target list as Ukrainian address ranges and does not confirm that any camera was actually compromised. Command history also shows malicious pages planted on Microsoft Exchange servers and attempts to use a flaw in the Roundcube webmail software, CVE-2025-49113. A second address, 129[.]146[.]87[.]174, was used as a staging server on Oracle Cloud in the United States. Group-IB treats 46[.]8[.]236[.]121 as confirmed command-and-control infrastructure for this operator, and recommends searching logs back to at least April 2025.
This is not an isolated story. In the past few days, ConnectWise confirmed that attackers abused ScreenConnect at managed service providers (MSPs) and pushed a second, attacker-controlled remote access client into customer environments: https://www.redtigersecurity.com/advisory/screenconnect-msp-campaign-rogue-remote-access . PHP2Shell flaws in industrial remote-access portals and routers can give an attacker a foothold at the site edge before a vendor session ever starts: https://www.redtigersecurity.com/advisory/php2shell-industrial-remote-access-routers . Stolen FortiGate configuration files, which we covered as FortiBleed 2.0, hand over VPN users, admin accounts and directory credentials, the same class of secret DarkLunnen pulled from a stolen FortiGate configuration: https://www.redtigersecurity.com/advisory/fortibleed-2-0 . Sites that use Ivanti Connect Secure as the front door for vendors were told in October they must patch again because the first fix did not close the root flaw in an exploited chain: https://www.redtigersecurity.com/advisory/ivanti-connect-secure-chain-root-fix . France has attributed the October refrigeration-controller attacks, which reached internet-facing controllers and changed setpoints, to Shahid Kaveh, a cyber group of Iran's Islamic Revolutionary Guard Corps: https://www.redtigersecurity.com/advisory/france-attributes-refrigeration-attacks-irgc . CISA's joint advisory AA26-097A earlier described Iranian cyber actors targeting internet-exposed programmable logic controllers (PLCs): https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-097a . DarkLunnen has not been tied to those actors. The common thread is the path: remote access left on the internet, or always-on vendor tools inside the plant.
Red Tiger has completed more than 500 OT cybersecurity assessments and trained more than 4,500 people, and we find insecure remote access in almost every assessment we do. What that usually looks like is a vendor VNC, TeamViewer or ScreenConnect session left running all the time, shared or default passwords, no multifactor authentication (MFA), a direct path from the internet to a panel or engineering workstation, and no record of who connected or what they did.
Book an OT cybersecurity assessment and the Red Tiger team will walk the remote access path from the perimeter to the control room and the field devices. Our team can also implement secure remote access, including a DMZ jump host, MFA, session recording and on-demand vendor access, and install a firewall and sensor at the site connected to the Red Tiger 24x7 Security Operations Center (SOC) for ongoing detection and response, with metrics and reports, so an unexpected session into the plant is spotted and handled quickly.
We are here to help, so check out our resources online at www.redtigersecurity.com and book a follow-up call with our team if you have any questions: https://calendly.com/jonathanpollet/30min
Sources: Group-IB, "Inside The Server: 14 Months of Offensive Cyber Operations Targeting Europe," 11 November 2026 https://www.group-ib.com/blog/offensive-cyber-operations-europe/
Check out our resources and book a follow-up call with our team.
