Pro-Russian hacktivists claim attacks forcing refrigeration controllers into defrost mode across European supermarkets and medical sites
Unit 42 reports on the wave of cyberattacks against refrigeration controllers in Europe, in which unidentified threat actors gained unauthorized access to internet-exposed units and set them to defrost mode, spoiling stock in hundreds of supermarkets. The first wave struck overnight on Oct. 11–12, 2026, hitting roughly 700 supermarkets in France; a second wave overnight on Nov. 1–2, 2026 reached at least 10 additional European countries and over 100–115 retail locations. French authorities later disclosed that refrigeration systems at medical facilities were also affected, with no evidence so far that blood products were spoiled. Multiple sources report temperatures driven as high as 50°C (122°F), in some cases causing fires. On Nov. 3, 2026 the pro-Russian hacktivist groups NoName057(16) and Z-Pentest claimed responsibility on Telegram, though the claims remain unverified.
Detalhes técnicos
The initial access vector remains unconfirmed. Speculation centres on vulnerable software versions and manufacturer default credentials on exposed controllers. CISA issued an advisory on Nov. 5, 2026 warning of potential exploitation via authentication bypass, arbitrary code injection and weak configurations; press reporting describes it as a joint advisory with the FBI, HHS and other agencies covering retail grocery and cold storage operators (scworld.com). CERT-FR's advisory of mid-October named compromises involving Danfoss AK-SM and AK-SC, Copeland xweb and Dixell xweb refrigeration controllers (esecurityplanet.com); no CVE has been attributed to this activity. Between Nov. 5–6, 2026, Unit 42 observed over 5,000 internet-exposed devices from the manufacturers listed by CERT-FR using Cortex Xpanse, noting that exposure does not imply vulnerable firmware. French exposure declined markedly from 1,853 devices in the Oct. 1–15 period.
Remediação
Remove refrigeration and building-management controllers from direct internet exposure, replace default manufacturer credentials, restrict administrative interfaces, update controller firmware and monitor control-plane traffic for anomalous setpoint or defrost commands. Unit 42 points to Cortex Xpanse for external exposure discovery, Device Security for OT/IoT visibility and weak-configuration detection, and Frontier Virtual Patching with Advanced Threat Prevention for inline blocking of exploit attempts and code injection.
Linha do tempo
-
Pro-Russian hacktivists claim attacks forcing refrigeration controllers into defrost mode across European supermarkets and medical sites
ler a análise desta fonte ocultar
Unit 42 reports on the wave of cyberattacks against refrigeration controllers in Europe, in which unidentified threat actors gained unauthorized access to internet-exposed units and set them to defrost mode, spoiling stock in hundreds of supermarkets. The first wave struck overnight on Oct. 11–12, 2026, hitting roughly 700 supermarkets in France; a second wave overnight on Nov. 1–2, 2026 reached at least 10 additional European countries and over 100–115 retail locations. French authorities later disclosed that refrigeration systems at medical facilities were also affected, with no evidence so far that blood products were spoiled. Multiple sources report temperatures driven as high as 50°C (122°F), in some cases causing fires. On Nov. 3, 2026 the pro-Russian hacktivist groups NoName057(16) and Z-Pentest claimed responsibility on Telegram, though the claims remain unverified.
Technical Details
The initial access vector remains unconfirmed. Speculation centres on vulnerable software versions and manufacturer default credentials on exposed controllers. CISA issued an advisory on Nov. 5, 2026 warning of potential exploitation via authentication bypass, arbitrary code injection and weak configurations; press reporting describes it as a joint advisory with the FBI, HHS and other agencies covering retail grocery and cold storage operators (scworld.com). CERT-FR's advisory of mid-October named compromises involving Danfoss AK-SM and AK-SC, Copeland xweb and Dixell xweb refrigeration controllers (esecurityplanet.com); no CVE has been attributed to this activity. Between Nov. 5–6, 2026, Unit 42 observed over 5,000 internet-exposed devices from the manufacturers listed by CERT-FR using Cortex Xpanse, noting that exposure does not imply vulnerable firmware. French exposure declined markedly from 1,853 devices in the Oct. 1–15 period.
Remediation
Remove refrigeration and building-management controllers from direct internet exposure, replace default manufacturer credentials, restrict administrative interfaces, update controller firmware and monitor control-plane traffic for anomalous setpoint or defrost commands. Unit 42 points to Cortex Xpanse for external exposure discovery, Device Security for OT/IoT visibility and weak-configuration detection, and Frontier Virtual Patching with Advanced Threat Prevention for inline blocking of exploit attempts and code injection.