Something like that indeed.
Every active network connection, every process, every piece of hardware and others are in your file system.
Then there’s also the possibility for linking to a file and links take up no space, but can show up like files.
You can use a command like ‘stat’ to get more information about a file (or directory).
“Pro-russia hacktivists” that’s a weird way to say “state sponsored hackers”. Also they are using open VNC and default passwords? Really? The parties responsible for that infrastructure should be ashamed.