CISA, FBI warn of attacks on internet-exposed industrial refrigeration controllers after Danfoss, Copeland/Dixell and Coolworld incidents
CISA, the FBI and other federal agencies published a joint advisory on November 5, 2026. It warns of malicious activity targeting industrial refrigeration and cold chain monitoring systems globally. Attackers exploit vulnerabilities or weaknesses in unpatched or internet-accessible controllers to remotely alter settings and force units into continuous heating and defrost cycles. This can cause widespread inventory loss and equipment hazards. The warning follows European incidents: supermarkets hit through systems administered by Danfoss (reported October 11), a similar incident on November 1 affecting supermarkets in at least nine European countries, and a cyber-attack on Coolworld that reportedly pushed cold storage rooms at France's blood service (EFS) to 110°C. No threat actor has been attributed.
Entenda a falha
A vulnerabilidade
No CVE is assigned. The CISA/FBI advisory of November 5, 2026 warns that attackers are using authentication bypass, arbitrary code injection and weak configurations on internet-exposed industrial refrigeration and cold chain controllers. The products named as compromised are Danfoss StoreView and Copeland/Dixell XWEB, and a Coolworld system was hit in a separate attack. The attacker needs network reach to an exposed controller panel. They can then remotely change settings and force continuous heating and defrost cycles. The articles give no affected or fixed versions, only advice to update to the latest version.
Como funciona
The articles do not describe the vulnerable code path. In general terms, these controllers handle remote monitoring of temperature, temperature logging, defrost cycle management and energy optimization, and their panels are reachable from the internet. An attacker who reaches a panel gets past authentication, injects code or uses weak or default settings, and gains remote access. From there they change the temperature and defrost parameters, so the units heat instead of cooling. Reported results were temperatures up to 50°C in the Danfoss case and 110°C in the Coolworld case.
Por que é vulnerável
The advisory points to three weakness classes rather than one root cause: authentication that can be bypassed, code that can be injected, and weak configurations such as default passwords. Exposing controller panels directly to the internet makes all of them reachable. Unpatched and end-of-life devices add to the risk. The articles do not say why these flaws went unnoticed or what a vendor fix changes.
Como foi descoberta
The activity came to light through incidents in Europe: supermarkets hit through systems administered by Danfoss (reported October 11), a similar incident on November 1 affecting supermarkets in at least nine countries, and a cyber-attack on Coolworld that reportedly pushed France's blood service (EFS) cold rooms to 110°C. CISA, the FBI and other agencies then issued the joint advisory on November 5. Censys data from the same day shows a 53% drop in exposed Danfoss StoreView and Copeland/Dixell XWEB controllers. Censys says this is consistent with provider action or owners disconnecting devices. No threat actor has been attributed.
Explicação gerada por IA a partir da matéria e dos artigos, em 06/11/2026 10:20.
Detalhes técnicos
- The agencies list three access paths: authentication bypass, arbitrary code injection and weak configurations on internet-exposed systems (infosecurity-magazine.com).
- Sectors highlighted in the advisory: healthcare, chemical, food and agriculture, and transportation (infosecurity-magazine.com).
- Censys data from November 5 shows a 53% drop in internet-exposed controllers across Danfoss StoreView and Copeland/Dixell XWEB, the products compromised in the October 11 and November 2 incidents respectively. The drop is consistent with provider action or owners disconnecting devices (infosecurity-magazine.com).
- The Danfoss attackers reportedly set temperatures as high as 50°C (infosecurity-magazine.com).
Remediação
- Do not expose controller panels to the internet.
- If remote access is required, place it behind a firewall or edge device and keep it updated.
- Isolate OT from business networks.
- Change default passwords and enforce phishing-resistant MFA.
- Retire end-of-life devices through a lifecycle management process.
- Restrict changes to authorized devices and IP addresses.
- Keep tested offline and offsite backups.
Linha do tempo
-
CISA, FBI warn of attacks on internet-exposed industrial refrigeration controllers after Danfoss, Copeland/Dixell and Coolworld incidents
ler a análise desta fonte ocultar
CISA, the FBI and other federal agencies published a joint advisory on November 5, 2026. It warns of malicious activity targeting industrial refrigeration and cold chain monitoring systems globally. Attackers exploit vulnerabilities or weaknesses in unpatched or internet-accessible controllers to remotely alter settings and force units into continuous heating and defrost cycles. This can cause widespread inventory loss and equipment hazards. The warning follows European incidents: supermarkets hit through systems administered by Danfoss (reported October 11), a similar incident on November 1 affecting supermarkets in at least nine European countries, and a cyber-attack on Coolworld that reportedly pushed cold storage rooms at France's blood service (EFS) to 110°C. No threat actor has been attributed.
Technical Details
- The agencies list three access paths: authentication bypass, arbitrary code injection and weak configurations on internet-exposed systems (infosecurity-magazine.com).
- Sectors highlighted in the advisory: healthcare, chemical, food and agriculture, and transportation (infosecurity-magazine.com).
- Censys data from November 5 shows a 53% drop in internet-exposed controllers across Danfoss StoreView and Copeland/Dixell XWEB, the products compromised in the October 11 and November 2 incidents respectively. The drop is consistent with provider action or owners disconnecting devices (infosecurity-magazine.com).
- The Danfoss attackers reportedly set temperatures as high as 50°C (infosecurity-magazine.com).
Remediation
- Do not expose controller panels to the internet.
- If remote access is required, place it behind a firewall or edge device and keep it updated.
- Isolate OT from business networks.
- Change default passwords and enforce phishing-resistant MFA.
- Retire end-of-life devices through a lifecycle management process.
- Restrict changes to authorized devices and IP addresses.
- Keep tested offline and offsite backups.