4 ms·

Maybe some of these vnc servers were put up after the machines were broken into, as a means of remote access for the attackers.

• Volundr 12y ago
  Possibly, but several of them seem to be QEMU instances with VNC setup.
• Alupis 12y ago
  No, he probably got one of the many CirrOS boxes, which tell you the username and password, alongside a kind note that the default user has full sudo privileges.