CISA, FBI and partners warn of global attacks on internet-exposed industrial refrigeration and cold-chain controllers
Matéria consolidada. Reúne 4 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 3 fontes trouxeram em 10/11/2026 00:06; os links antigos trazem para cá.
Fontes: tenable.com ↗ securityaffairs.com ↗ thehackernews.com ↗
CISA, the FBI, HHS, the USDA and the Department of Transportation published a joint advisory (fact sheet dated 5 November 2026) warning that threat actors are actively targeting internet-exposed industrial refrigeration and cold-chain monitoring controllers worldwide (thehackernews.com, securityaffairs.com, tenable.com). The agencies say the actors remotely alter settings and force units into continuous heating and defrost cycles. The effects range from spoiled inventory to fire hazards (thehackernews.com). The warning follows attacks on hundreds of supermarkets, small grocers and butchers across twelve European countries, where temperatures were pushed as high as 50 °C or units were forced into defrost (thehackernews.com). One victim was the French Blood Establishment, which confirmed that an incident at a refrigeration equipment provider raised temperature and defrost settings to extremely high levels at three blood plasma storage facilities (thehackernews.com). The National Cybersecurity Agency of France (ANSSI) has investigated since mid-October and reports compromises involving Danfoss AK-SM and AK-SC series controllers, Copeland controllers and Dixell XWEB controllers (tenable.com). No attribution has been established and the advisory names no CVE (thehackernews.com). Tenable (tenable.com) did not retrieve the Danfoss and Copeland vendor advisories, so no CVE or fixed firmware version is confirmed. The affected sectors are healthcare, chemicals, food production, agriculture and transport, including refrigerated trucks and delivery services. These organizations use the systems to monitor temperatures, keep logs, run defrost cycles and save energy (thehackernews.com, securityaffairs.com).
Entenda a falha
A vulnerabilidade
No CVE is assigned and no single flaw is identified. The joint advisory from CISA, FBI, HHS, USDA and DOT says actors are likely to abuse authentication bypasses, arbitrary code injection and weak configurations (default or hard-coded credentials, legacy devices) in unpatched, internet-exposed refrigeration and cold-chain controllers. ANSSI names Danfoss AK-SM and AK-SC series, Copeland controllers and Dixell XWEB controllers as compromised in France. With remote reach, an attacker can change temperature and defrost settings, which spoils stock, creates a fire hazard and can hide the damage through denial of service. Affected and fixed versions are not stated, and Tenable did not retrieve the vendor advisories.
Como funciona
The controllers monitor temperatures, keep logs and run defrost cycles, and in the affected deployments they are reachable from the internet. An attacker connects remotely to the controller's management interface and gets in through an authentication bypass, code injection, or default or weak credentials. Once inside, the attacker changes setpoints and defrost settings, forcing continuous heating and defrost, with temperatures reported as high as 50 °C. The controller applies these commands without any safety limit, and a denial of service can also remove operators' view of current temperatures. The articles do not detail the exact request path or which interface is abused.
Por que é vulnerável
The articles point to exposure and weak access control rather than one defect: controllers reachable from the internet, default or hard-coded passwords, unpatched firmware, end-of-life devices, and unnamed authentication and code-injection weaknesses. Nothing prevents a controller from being pushed past safe temperatures whoever gives the order. The sources disagree on emphasis: The Hacker News stresses authentication bypass and code injection, while Tenable stresses default or weak credentials and exposure rather than a single unauthenticated flaw. No fix is described.
Como foi descoberta
The issue surfaced through attacks seen in the wild: in recent weeks hundreds of supermarkets, small grocers and butchers were hit, and the French Blood Establishment confirmed raised temperatures at three plasma storage sites. ANSSI says it has investigated since mid-October. CISA, FBI, HHS, USDA and DOT then published the joint advisory (fact sheet dated 5 November 2026). Censys tracked exposed Danfoss StoreView and Copeland/Dixell XWEB instances. No researcher, threat actor, CVE or vulnerability report is named, and attribution is unknown.
Explicação gerada por IA a partir da matéria e dos artigos, em 10/11/2026 00:21.
Detalhes técnicos
- The agencies assess that actors are likely to abuse authentication bypasses, arbitrary code injection and weak configurations, including default credentials and legacy devices, to reach the controllers (thehackernews.com). The advisory describes this as exploiting vulnerabilities or weaknesses in unpatched or internet-accessible controllers.
- Entry points named by the agencies are unpatched vulnerabilities, misconfigurations, and weak or hard-coded passwords. Tenable (tenable.com) notes the access path relies on default or weak credentials and internet exposure rather than a single unauthenticated flaw.
- Targets are electronic-temperature and commercial-refrigeration controllers in grocery stores and cold storage facilities, reached remotely (tenable.com). Once inside, attackers manipulate temperature controls to spoil refrigerated products such as blood and food (tenable.com).
- Controller families named by ANSSI in the affected French incidents: Danfoss AK-SM and AK-SC series, Copeland controllers and Dixell XWEB controllers (tenable.com).
- Effects include temperature manipulation that shortens equipment service life, creates a fire hazard, destroys inventory or endangers consumers of improperly stored products. Denial-of-service can also remove visibility into temperatures (thehackernews.com).
- Censys data shows Danfoss StoreView internet-exposed instances falling from 3,004 to 708 between 9 October and 5 November 2026, most of them in France. Copeland/Dixell XWEB exposure fell from 3,708 to 2,420 (thehackernews.com).
- Censys also reports that North America accounts for roughly 38% of global ICS exposure. Asia's share rose from 22% in 2024 to 25% in 2026, while Europe's fell from 36.5% to 32% (thehackernews.com).
- No malware family, IOC or threat actor is named in the sources (tenable.com, thehackernews.com).
Remediação
- Enforce strong authentication and change default passwords (thehackernews.com, tenable.com).
- Keep controllers patched and promptly patch critical vulnerabilities (thehackernews.com, tenable.com).
- Inventory and remove internet-accessible systems (thehackernews.com, tenable.com).
- Isolate OT devices from IT and business networks (thehackernews.com, tenable.com).
- Retire and replace legacy equipment, including devices that have reached end-of-life (thehackernews.com, tenable.com).
- Remove unnecessary remote access and harden the remote access that remains (thehackernews.com, tenable.com).
- Maintain offsite backups (tenable.com).
- Securityaffairs.com summarizes the fixes as basic, with most starting by getting the controllers off the internet.
Relatos divergentes
- Scope: thehackernews.com reports attacks on hundreds of supermarkets, small grocers and butchers across twelve European countries. Tenable (tenable.com, more recent, 9 November) describes hundreds of grocery stores in France and does not mention the twelve-country figure; the two may describe different scopes and the broader figure is not confirmed there.
- Fire impact: tenable.com says fires were triggered in the European attacks, while the agencies' warning, as reported by thehackernews.com, describes fire as a hazard. Actual fire incidents are not corroborated by the other sources.
- Access path: thehackernews.com stresses likely authentication bypasses and arbitrary code injection, whereas tenable.com stresses default, weak or hard-coded credentials and exposure rather than a single unauthenticated flaw. No CVE is confirmed by either source.
Linha do tempo
-
Attacks on refrigeration and cold-chain controllers in France prompt joint US warning to critical infrastructure
ler a análise desta fonte ocultar
CISA, the FBI, HHS, USDA and the Department of Transportation published a joint fact sheet warning that attackers are remotely targeting electronic-temperature and commercial-refrigeration controllers used in grocery stores and cold storage. The warning follows attacks on French blood banks and European supermarkets, where hundreds of grocery stores in France had food spoiled and fires triggered. The National Cybersecurity Agency of France (ANSSI) has investigated since mid-October and reports compromises involving Danfoss AK-SM and AK-SC series controllers, Copeland controllers and Dixell XWEB controllers. Intruders take advantage of unpatched flaws, misconfigurations and weak or hard-coded passwords, and once inside they can alter temperature controls, with fire risk as a consequence. Urgency is rated critical because the activity is ongoing, has reached multiple sectors and affects physical processes, although the access path relies on default or weak credentials and internet exposure rather than a single unauthenticated flaw. The vendor advisories from Danfoss and Copeland were not retrieved during this research, so no CVE or fixed firmware version is confirmed here.
Technical Details
- Targets are electronic-temperature and commercial-refrigeration controllers in grocery stores and cold storage facilities, reached remotely.
- Entry points named by the agencies are unpatched vulnerabilities, misconfigurations, and weak or hard-coded passwords.
- Once remote access is obtained, attackers manipulate temperature controls to spoil refrigerated products such as blood and food; the agencies note that temperature changes could also trigger fires.
- Controller families named by ANSSI in the affected French incidents: Danfoss AK-SM and AK-SC series, Copeland controllers, and Dixell XWEB controllers.
- No malware family, IOC or threat actor is named in the article or the pages consulted.
Remediation
The joint fact sheet recommends organizations immediately:
- Use strong authentication mechanisms and change default passwords.
- Keep systems updated and promptly patch critical vulnerabilities.
- Replace legacy devices that have reached end-of-life status.
- Identify systems accessible from the internet.
- Isolate operational technology (OT) systems from business networks.
- Remove unnecessary remote access and secure the remote access that remains necessary.
- Maintain offsite backups.
-
CISA and the FBI Warn Of Attacks against Industrial Refrigeration Controllers
ler a análise desta fonte ocultar
US agencies warn attackers are going after industrial refrigeration controllers. The fixes are basic, and most start with getting them off the internet.
CISA, the FBI, HHS, USDA and the Department of Transportation published a joint advisory on attacks against industrial refrigeration controllers and cold chain monitoring systems. The activity is global. Healthcare, chemical, food and transport companies use these systems to watch temperatures, keep logs, run defrost cycles and save energy, including in refrigerated trucks.
-
CISA, FBI and partners warn of global attacks on industrial refrigeration and cold-chain controllers after European supermarket spree
ler a análise desta fonte ocultar
A joint U.S. federal advisory from CISA, the FBI, HHS, the USDA and the DOT warns that threat actors are actively targeting internet-exposed industrial refrigeration and cold-chain monitoring controllers worldwide, with effects ranging from spoiled inventory to fire hazards. The agencies state the actors exploit vulnerabilities or weaknesses in unpatched or internet-accessible controllers to remotely alter settings and force units into continuous heating and defrost cycles. The warning follows a wave of attacks on hundreds of supermarkets, small grocers and butchers across twelve European countries, where temperatures were pushed as high as 50 °C or units forced into defrost. Among the victims was the French Blood Establishment, which confirmed an incident at a refrigeration equipment provider raised temperature and defrost settings to extremely high levels at three blood plasma storage facilities. No attribution has been established, and the advisory names no CVE. The fact sheet is dated 5 November 2026 and also covers healthcare, chemicals, food production, agriculture and transport, including refrigerated delivery services (cybersecuritynews.com).
Technical Details
The agencies assess that actors are likely to abuse authentication bypasses, arbitrary code injection and weak configurations — including default credentials and legacy devices — to reach the controllers. Observed and anticipated effects are temperature manipulation that shortens equipment service life, creates a fire hazard, destroys inventory or endangers consumers of improperly stored products, and loss of visibility into temperatures through denial-of-service. Exposure data from Censys shows Danfoss StoreView internet-exposed instances falling from 3,004 to 708 between 9 October and 5 November 2026, most of them in France, while Copeland/Dixell XWEB exposure fell from 3,708 to 2,420. Censys also reports North America accounts for roughly 38% of global ICS exposure, Asia's share rising from 22% in 2024 to 25% in 2026 and Europe's falling from 36.5% to 32%.
Remediation
Owners and operators are urged to enforce strong authentication, change default passwords, keep controllers patched, inventory and remove internet-accessible systems, isolate OT devices from IT networks, retire and replace legacy equipment, and remove unnecessary remote access while hardening the remote access that remains.