Sekoia Investigates Attacks on Exposed Danfoss Refrigeration Controllers
Summary
Sekoia’s investigation of October and November 2026 attacks on exposed Danfoss refrigeration controllers details disruptive parameter changes and a blocked unauthenticated exploit attempt; use of CVE-2025-41450 remains unconfirmed.
Key points
- The October attacks affected hundreds of supermarkets across France; a November wave affected refrigeration systems in about a dozen European countries.
- Sekoia reports that attackers changed temperature settings, defrost cycles, and alarm thresholds on exposed, unpatched Danfoss controllers.
- Honeypots recorded reconnaissance, password-spraying attempts, and a blocked attempt to rename an administrator account without authentication.
- Sekoia could not confirm whether attackers exploited CVE-2025-41450 in the first wave.
- French authorities attributed the operation to Iran’s Islamic Revolutionary Guard Corps, specifically the unit Shahid Kaveh; Sekoia also discusses the limits of the attribution evidence.
- Sekoia assesses the NoName057(16) and Z-Pentest responsibility claim as unsubstantiated.
- Recommended measures include removing controllers from direct Internet exposure, restricting remote administration, replacing default credentials, updating firmware, and monitoring authentication and configuration changes.
Article Details
- Attack Vectors
- Internet-exposed, unpatched Danfoss refrigeration controllers were remotely accessed and their temperature settings, defrost cycles, and alarm thresholds were modified.
- Honeypots received unauthenticated requests to enumerate controller units and associated IP addresses, as well as password-spraying attempts against Supervisor and admin accounts using the password "12345".
- A request attempting to rename an administrator account without authentication was observed against honeypots; Sekoia suspected it could be part of a broader exploit chain involving a subsequent password reset.
- Exploitation of CVE-2025-41450 during the attacks was not confirmed. Sekoia noted that requests to read_date_time might have been reconnaissance preceding an attempt to exploit it.
- Defensive Notes
- Remove refrigeration controllers and other ICS devices from direct Internet exposure.
- Restrict remote administration through secure access mechanisms and apply available firmware updates.
- Replace default credentials and monitor authentication attempts and configuration changes.
- Use network segmentation to reduce exposure of industrial control systems.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 178[.]83[.]226[.]215 | Source IP of a request attempting to exploit a vulnerability to rename a user account on a Sekoia honeypot. |
| IPV4 | 37[.]16[.]75[.]128 | Source IP of a request attempting to exploit a vulnerability to rename a user account on a Sekoia honeypot. |
MITRE ATT&CK
T0836The attackers modified refrigeration temperature settings, defrost cycles, and alarm thresholds on Danfoss controllers.T1110.003 · Password SprayingHoneypots received password-spraying attempts against the Supervisor and admin accounts using the password "12345".T1190 · Exploit Public-Facing ApplicationThe reported attacks targeted Internet-exposed Danfoss controllers, and a request attempted to exploit an unauthenticated account-renaming vulnerability.T1595 · Active ScanningThe article describes reconnaissance of exposed controllers, including requests to enumerate system units and their associated IP addresses.
CVE
Threat Actors
Cyber Isnaad FrontThe article explicitly identifies this as an alternate name associated with the CyberAveng3rs persona.CyberAv3ngersThe article explicitly identifies this as an alternate name associated with the CyberAveng3rs persona.CyberAveng3rsThe article identifies this as a persona used by Shahid Kaveh and describes it as the best-known name associated with the unit.Islamic Revolutionary Guard Corps Cyber Electronic CommandThe article says Shahid Kaveh is linked to this command and reports French authorities' attribution of the operation to the unit.NoName057(16)The group claimed responsibility, but Sekoia assesses the claim as unsubstantiated and notes its history of misleading claims; the article associates it primarily with DDoS operations.Shahid KavehFrench authorities attributed the operation to this unit on 9 November 2026; Sekoia describes it as linked to the Islamic Revolutionary Guard Corps Cyber Electronic Command.Z-PentestThe group made a claim concerning the incidents that Sekoia assesses as unsubstantiated.
Vendors
Products
Tools
CensysFollowing the first campaign, we wanted to know the impact of the campaign. Sekoia observed via Censys more than 2,700 Danfoss systems exposed worldwide as of October 11, including approximately 1,700 in France. By 4:00GLM 5.3The following day, equipped with GLM 5.3 and Danfoss firmware images downloaded from the company's website, we set out to understand the purpose of this request and determine whether it might fit into a broader exploit
Countries
Belgiumwave of attacks impacted refrigeration systems across around a dozen European countries, including Belgium, the Netherlands, Germany and Sweden, with the same modus operandi and final impact: food spoilage andFranceBetween 11-13 October 2026, hundreds of supermarkets across France, including stores operated by Intermarché and Coopérative U running unpatched Danfoss refrigeration control systems were affected by a large-scaleGermanyrefrigeration systems across around a dozen European countries, including Belgium, the Netherlands, Germany and Sweden, with the same modus operandi and final impact: food spoilage and business interruption. TheIranAttribution to Iran’s Islamic Revolutionary Guard CorpsIsraelPrevious precedents involve Danfoss controller targeted in Israel and in the USA, both geopolitical adversaries of Iran. In 2022, approximately 40 Israeli supermarkets operating Danfoss controllers were compromised.Netherlandsimpacted refrigeration systems across around a dozen European countries, including Belgium, the Netherlands, Germany and Sweden, with the same modus operandi and final impact: food spoilage and businessSwedensystems across around a dozen European countries, including Belgium, the Netherlands, Germany and Sweden, with the same modus operandi and final impact: food spoilage and business interruption. The same night,United StatesThe group is notably known for its attack on U.S. water and wastewater critical infrastructure. In late 2023, they gained prominence by compromising internet-exposed Unitronics PLCs at the Municipal Water Authority of