Hijacked Copeland XWEB refrigeration controllers form spam botnet and proxies amid European fridge sabotage
SecurityScorecard's STRIKE team reports that internet-exposed Copeland XWEB PRO refrigeration controllers, originally made by Dixell, are being hijacked into a suspected spam botnet and residential proxy infrastructure. Nine IP addresses first seen on November 2 sent email without receiving any, and three of them were confirmed as XWEB controllers; the three busiest nodes shared about 47% of their targets, which suggests a single coordinated operator, though the team rates its confidence as low to medium. Two other controllers were used as a tunnel gateway in Namibia and a proxy exit in Trinidad and Tobago. SecurityScorecard believes the entry point was CVE-2026-25085, a login check flaw that lets unauthenticated users bypass the password prompt, but has not linked the botnet to the European attacks on supermarkets, blood banks and cold rooms. A separate Ransom-ISAC analysis describes a November 2 intrusion into another XWEB Pro controller at a commercial refrigeration site, where two Administrator sessions used the factory default credentials to make 743 changes, including setpoints of 110°C and 150°C and alarm muting. Ransom-ISAC has no evidence tying that intrusion to NoName057(16) or Z-Pentest, whose claims over the supermarket attacks remain unconfirmed.
Entenda a falha
A vulnerabilidade
CVE-2026-25085 is a flaw in the login check of the Copeland XWEB PRO refrigeration controllers (originally made by Dixell). An unauthenticated user who can reach the controller can get past the password prompt. The articles do not give affected or fixed versions, and the vendor and CISA advisories were not retrieved. A separate, non-CVE problem is also in play: in the Ransom-ISAC case the controller still used the factory Administrator credentials, so no vulnerability was needed.
Como funciona
The XWEB controller exposes a web panel that lets technicians check temperatures and change settings remotely. When someone reaches the panel from the internet, the login check is supposed to stop anyone without valid credentials. With CVE-2026-25085, that check can be bypassed, so an unauthenticated user gets in. Once inside, the controller is a small Linux computer with a stable IP address that nobody monitors. It can then be used to send spam, tunnel traffic or act as a proxy exit.
Por que é vulnerável
The articles describe the root cause only as a flaw in the controller's login check that lets an unauthenticated user pass the password prompt. They do not give the code-level reason or say what the fix changes. Exposure is made worse by operational factors: the controllers sit on the internet, often go without updates because updating means taking equipment offline, and third parties managing them remotely often do not install updates. Some devices also keep factory default credentials.
Como foi descoberta
CVE-2026-25085 is one of 23 vulnerabilities that Claroty Team82 reported to CISA, which published an advisory in February. The botnet activity was found by SecurityScorecard's STRIKE team, which filtered internet scan data to genuine XWEB controllers and examined their traffic. SecurityScorecard assumes CVE-2026-25085 was the entry point, but this is not a confirmed exploitation path, and its confidence is low to medium. Ransom-ISAC separately analyzed a November 2 intrusion that used default credentials.
Explicação gerada por IA a partir da matéria e dos artigos, em 09/11/2026 12:26.
Detalhes técnicos
The botnet activity was found by filtering internet scan data to genuine XWEB controllers and then examining their network traffic. The Namibian node carried 71% of all traffic in the captured data, and the Trinidad and Tobago node contacted 10,643 hosts in 17 hours. SecurityScorecard describes the controllers as small Linux computers with stable IP addresses that no security team monitors, which lets an intrusion persist for weeks or months. The CVE-2026-25085 attribution is the vendor-neutral assumption of the researchers, not a confirmed exploitation path. The article notes that CVE-2026-25085 is one of 23 vulnerabilities Claroty Team82 reported to CISA, which published an advisory in February. In the Ransom-ISAC case, the attacker needed no vulnerability because the default Administrator login was still in place. The event log cannot show what temperatures the equipment reached or whether food was lost.
Remediação
The vendor advisory from Copeland or Dixell and the CISA advisory were not retrieved during this analysis, so no fixed firmware version is confirmed here. Operators should take XWEB controllers off the public internet, replace factory Administrator credentials, apply vendor updates for CVE-2026-25085 once they are confirmed, and log and alert on remote configuration changes. As SecurityScorecard advises, IPs found in this activity should be handled as victims or abused infrastructure, not as adversary-owned assets.
Linha do tempo
-
Hijacked Copeland XWEB refrigeration controllers form spam botnet and proxies amid European fridge sabotage
ler a análise desta fonte ocultar
SecurityScorecard's STRIKE team reports that internet-exposed Copeland XWEB PRO refrigeration controllers, originally made by Dixell, are being hijacked into a suspected spam botnet and residential proxy infrastructure. Nine IP addresses first seen on November 2 sent email without receiving any, and three of them were confirmed as XWEB controllers; the three busiest nodes shared about 47% of their targets, which suggests a single coordinated operator, though the team rates its confidence as low to medium. Two other controllers were used as a tunnel gateway in Namibia and a proxy exit in Trinidad and Tobago. SecurityScorecard believes the entry point was CVE-2026-25085, a login check flaw that lets unauthenticated users bypass the password prompt, but has not linked the botnet to the European attacks on supermarkets, blood banks and cold rooms. A separate Ransom-ISAC analysis describes a November 2 intrusion into another XWEB Pro controller at a commercial refrigeration site, where two Administrator sessions used the factory default credentials to make 743 changes, including setpoints of 110°C and 150°C and alarm muting. Ransom-ISAC has no evidence tying that intrusion to NoName057(16) or Z-Pentest, whose claims over the supermarket attacks remain unconfirmed.
Technical Details
The botnet activity was found by filtering internet scan data to genuine XWEB controllers and then examining their network traffic. The Namibian node carried 71% of all traffic in the captured data, and the Trinidad and Tobago node contacted 10,643 hosts in 17 hours. SecurityScorecard describes the controllers as small Linux computers with stable IP addresses that no security team monitors, which lets an intrusion persist for weeks or months. The CVE-2026-25085 attribution is the vendor-neutral assumption of the researchers, not a confirmed exploitation path. The article notes that CVE-2026-25085 is one of 23 vulnerabilities Claroty Team82 reported to CISA, which published an advisory in February. In the Ransom-ISAC case, the attacker needed no vulnerability because the default Administrator login was still in place. The event log cannot show what temperatures the equipment reached or whether food was lost.
Remediation
The vendor advisory from Copeland or Dixell and the CISA advisory were not retrieved during this analysis, so no fixed firmware version is confirmed here. Operators should take XWEB controllers off the public internet, replace factory Administrator credentials, apply vendor updates for CVE-2026-25085 once they are confirmed, and log and alert on remote configuration changes. As SecurityScorecard advises, IPs found in this activity should be handled as victims or abused infrastructure, not as adversary-owned assets.