Refrigeration Controller Attacks Spread Across Countries, Attribution Remains Unclear

Nov 9, 2026 · Original article ↗

Summary

An analysis links attacks on refrigeration controllers across multiple countries to exposed interfaces and default credentials, while assessing US exposure and defensive steps. Claims by NoName057(16) and Z-Pentest remain unproven.

Key points

Attackers reportedly used internet-exposed controller interfaces and factory-default credentials to raise temperature setpoints or force defrost, generally without malware or exploits.
Reported impacts include spoiled stock, equipment damage and fires in some French stores; a blood-service contractor’s cold rooms were also affected, but no public evidence links that incident to the wider waves.
NoName057(16) claimed attacks on Danfoss and Dixell equipment in a video, but provided no proof of access. Z-Pentest described similar activity without claiming the large waves; no government has attributed the campaign.
Decoy Danfoss controllers recorded 256 login attempts from 91 sources between October 20 and 30, mostly using default credentials; all attempts were rejected.
SOCRadar observed exposed refrigeration and other OT interfaces in the US, Canada and UK. The article cautions that exposure counts include decoys and do not establish compromise.
The article recommends removing controller interfaces from the public internet, replacing default credentials, updating or retiring affected firmware, segmenting OT networks and monitoring for abnormal defrost, setpoint and alarm activity.

Article Details

Attack Vectors: For the reported refrigeration waves, attackers mainly logged in to internet-exposed controller management interfaces using publicly documented factory-default credentials; the article reports no malware or exploit use in that attack chain.
After gaining access, attackers used normal controller-interface functions to raise temperature setpoints or keep defrost mode on, sometimes after disabling alarms.
Honeypot activity consisted of standard login attempts, mostly using default credentials; the article says these attempts were not use of the CVE-2025-41450 authentication bypass.
The article identifies exposed interfaces and known vulnerabilities as possible access paths, but does not establish that the disclosed vulnerabilities were used in the reported waves.
Defensive Notes: Remove controller management interfaces from the public internet; restrict access to a VPN or secured network.
Replace factory-default and shared credentials on every controller, enable MFA where supported, and rotate contractor and remote-service passwords.
Update Danfoss AK-SM firmware to 4.3.1 or later, Copeland XWEB PRO to 1.13 or later, and Copeland E3 to 2.31F01 or later; take XWEB EVO units offline and migrate to XWEB PRO as Copeland advised.
Replace or isolate end-of-life AK-SM 800 and AK-SC 355 units.
Block exposed VNC, BACnet/IP, and Niagara Fox ports at the network edge; use secure remote access and retire unsupported Niagara 3.x stations.
Segment refrigeration and building controllers from corporate and point-of-sale networks, and audit contractors' remote-access paths and shared accounts.
Use independent high-limit cutoffs and alarms delivered through channels the controller cannot silence, such as phone or SMS; rehearse manual operation.
Alert on unscheduled defrost, abnormal setpoints, disabled alarms, and management-interface logins between 1:00 and 4:00 a.m. local time.