Refrigeration OT Attacks Highlight Remote-Access Risks Across Connected Systems

Article Details

Defense Focus

Secure remote access to operational technology controllers and detect unauthorized changes to control settings.

Detection Methods

• Maintain an inventory of supervisory and field controllers, including contractor-installed, rented, and cellular-connected equipment, with model, firmware, network path, and remote-access method.
• Use passive OT discovery to identify devices communicating over BACnet, Modbus, and similar protocols.
• Scan external attack surfaces for exposed management interfaces, using vendor-specific page titles such as StoreView and XWEB and checking the cited BACnet, Modbus TCP, and Niagara Fox ports.
• Correlate controller audit logs with VPN and access-gateway logs, maintenance schedules, and access records.
• Alert on setpoint or defrost-schedule changes, new user accounts, and authentication activity outside approved maintenance windows.
• Use independent temperature monitoring with direct on-call alerts so detection does not depend solely on the potentially compromised controller.

Data Sources

• Controller audit logs and configuration-change records
• VPN and access-gateway logs, including session records
• Maintenance schedules and access records
• Independent temperature sensors and logger alerts
• OT network traffic, including BACnet and Modbus communications
• Asset inventory records, including controller models, firmware versions, and remote-access paths

Platforms

• Central monitoring platform
• VPN or privileged access gateway with session logging
• Passive OT discovery tools
• Independent temperature monitoring system
• Privileged access management or password vault

Defensive Actions

• Remove direct internet exposure, including unnecessary port forwarding and public IP assignments; route remote access through a controlled, logged entry point.
• Segment controllers into dedicated network zones and separate read-only monitoring from control functions.
• Use individual named accounts and role-based permissions; restrict write access and remote sessions to approved users and maintenance windows.
• Change factory-default and shared credentials, use MFA at the VPN or access gateway, store service credentials securely, and revoke access promptly when roles or engagements end.
• Track controller firmware, apply vendor updates, and plan replacement of end-of-life equipment; isolate unsupported systems until replacement.
• Apply security onboarding and access requirements to maintenance and rental providers, including patched connecting devices, endpoint protection, disk encryption, and session logging.
• For high-consequence systems, remove remote control or isolate the controller where practical, retaining independent local alarms and temperature monitoring.
• For exposed or potentially compromised controllers, restrict access, factory-reset the device, apply available updates, rotate secrets, review accounts, and fully reconfigure it.