CISA, FBI and partners warn of global attacks on internet-exposed industrial refrigeration and cold-chain controllers
Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 09/11/2026 12:13; os links antigos trazem para cá.
CISA, the FBI, HHS, the USDA and the Department of Transportation published a joint advisory (fact sheet dated 5 November 2026) warning that threat actors are actively targeting internet-exposed industrial refrigeration and cold-chain monitoring controllers worldwide (thehackernews.com, securityaffairs.com). The agencies say the actors remotely alter settings and force units into continuous heating and defrost cycles. The effects range from spoiled inventory to fire hazards (thehackernews.com). The warning follows attacks on hundreds of supermarkets, small grocers and butchers across twelve European countries, where temperatures were pushed as high as 50 °C or units were forced into defrost (thehackernews.com). One victim was the French Blood Establishment, which confirmed that an incident at a refrigeration equipment provider raised temperature and defrost settings to extremely high levels at three blood plasma storage facilities (thehackernews.com). No attribution has been established and the advisory names no CVE (thehackernews.com). The affected sectors are healthcare, chemicals, food production, agriculture and transport, including refrigerated trucks and delivery services. These organizations use the systems to monitor temperatures, keep logs, run defrost cycles and save energy (thehackernews.com, securityaffairs.com).
Detalhes técnicos
- The agencies assess that actors are likely to abuse authentication bypasses, arbitrary code injection and weak configurations, including default credentials and legacy devices, to reach the controllers (thehackernews.com). The advisory describes this as exploiting vulnerabilities or weaknesses in unpatched or internet-accessible controllers.
- Effects include temperature manipulation that shortens equipment service life, creates a fire hazard, destroys inventory or endangers consumers of improperly stored products. Denial-of-service can also remove visibility into temperatures (thehackernews.com).
- Censys data shows Danfoss StoreView internet-exposed instances falling from 3,004 to 708 between 9 October and 5 November 2026, most of them in France. Copeland/Dixell XWEB exposure fell from 3,708 to 2,420 (thehackernews.com).
- Censys also reports that North America accounts for roughly 38% of global ICS exposure. Asia's share rose from 22% in 2024 to 25% in 2026, while Europe's fell from 36.5% to 32% (thehackernews.com).
Remediação
- Enforce strong authentication and change default passwords (thehackernews.com).
- Keep controllers patched (thehackernews.com).
- Inventory and remove internet-accessible systems (thehackernews.com).
- Isolate OT devices from IT networks (thehackernews.com).
- Retire and replace legacy equipment (thehackernews.com).
- Remove unnecessary remote access and harden the remote access that remains (thehackernews.com).
- Securityaffairs.com summarizes the fixes as basic, with most starting by getting the controllers off the internet.
Linha do tempo
-
CISA and the FBI Warn Of Attacks against Industrial Refrigeration Controllers
ler a análise desta fonte ocultar
US agencies warn attackers are going after industrial refrigeration controllers. The fixes are basic, and most start with getting them off the internet.
CISA, the FBI, HHS, USDA and the Department of Transportation published a joint advisory on attacks against industrial refrigeration controllers and cold chain monitoring systems. The activity is global. Healthcare, chemical, food and transport companies use these systems to watch temperatures, keep logs, run defrost cycles and save energy, including in refrigerated trucks.
-
CISA, FBI and partners warn of global attacks on industrial refrigeration and cold-chain controllers after European supermarket spree
ler a análise desta fonte ocultar
A joint U.S. federal advisory from CISA, the FBI, HHS, the USDA and the DOT warns that threat actors are actively targeting internet-exposed industrial refrigeration and cold-chain monitoring controllers worldwide, with effects ranging from spoiled inventory to fire hazards. The agencies state the actors exploit vulnerabilities or weaknesses in unpatched or internet-accessible controllers to remotely alter settings and force units into continuous heating and defrost cycles. The warning follows a wave of attacks on hundreds of supermarkets, small grocers and butchers across twelve European countries, where temperatures were pushed as high as 50 °C or units forced into defrost. Among the victims was the French Blood Establishment, which confirmed an incident at a refrigeration equipment provider raised temperature and defrost settings to extremely high levels at three blood plasma storage facilities. No attribution has been established, and the advisory names no CVE. The fact sheet is dated 5 November 2026 and also covers healthcare, chemicals, food production, agriculture and transport, including refrigerated delivery services (cybersecuritynews.com).
Technical Details
The agencies assess that actors are likely to abuse authentication bypasses, arbitrary code injection and weak configurations — including default credentials and legacy devices — to reach the controllers. Observed and anticipated effects are temperature manipulation that shortens equipment service life, creates a fire hazard, destroys inventory or endangers consumers of improperly stored products, and loss of visibility into temperatures through denial-of-service. Exposure data from Censys shows Danfoss StoreView internet-exposed instances falling from 3,004 to 708 between 9 October and 5 November 2026, most of them in France, while Copeland/Dixell XWEB exposure fell from 3,708 to 2,420. Censys also reports North America accounts for roughly 38% of global ICS exposure, Asia's share rising from 22% in 2024 to 25% in 2026 and Europe's falling from 36.5% to 32%.
Remediation
Owners and operators are urged to enforce strong authentication, change default passwords, keep controllers patched, inventory and remove internet-accessible systems, isolate OT devices from IT networks, retire and replace legacy equipment, and remove unnecessary remote access while hardening the remote access that remains.