(TLP:CLEAR) U.S. Agencies Urge Hardening of Refrigeration Controllers after Attacks on Danfoss and Copeland Systems in Europe
Created: Thursday, November 12, 2026 - 14:25
Categories: Cybersecurity, Federal & State Resources, OT-ICS Security
Summary: CISA, the FBI, and three other federal agencies published a joint fact sheet on November 5 warning of malicious cyber activity targeting industrial refrigeration and cold chain monitoring systems globally. The warning follows two waves of attacks in Europe. In October, attackers altered settings on Danfoss AK-SM and AK-SC controllers and Copeland/Dixell XWEB controllers at roughly 700 French supermarkets, forcing defrost cycles that spoiled food. A second wave in early November reached stores in several more countries.
The attackers reached internet-exposed controllers and used the devices’ normal administrative functions. Danfoss has said most affected units were legacy AK-SM 800 and AK-SC 355 models that no longer receive security updates. A Ransom-ISAC analysis of one Copeland XWEB Pro compromise found the attackers logged in with default administrator credentials, made 743 parameter writes across 31 devices in about 35 minutes, muted alarms, and locked local keypads. Separately, SecurityScorecard observed compromised XWEB controllers being reused as proxy exits and spam senders. France’s Computer Emergency Response Team (CERT-FR) has attributed the operation to Shahid Kaveh, an Iranian IRGC-affiliated APT group whose public personas include CyberAv3ngers, known for targeting water utilities in the U.S.
Analyst Note: The products differ, but the conditions behind these attacks are common in water and wastewater: OT reachable from the internet, default or weak credentials, and remote access maintained by third-party integrators. CyberAv3ngers is the same group that claimed the recent PLC attacks in July 2026 that impacted over 100 facilities across 12 states (though unverified), and which similarly compromised Unitronics PLCs at U.S. water utilities in 2023 using very similar tactics.
Original Source: https://www.cisa.gov/resources-tools/resources/us-government-partners-urge-hardening-industrial-refrigeration-and-cold-chain-monitoring-systems
Additional Reading:
- A Dish Served Lukewarm: The Refrigerator Botnet (SecurityScorecard)
- The Copeland Incident (Ransom-ISAC)
- Over 100 European Stores Hit as Supermarket Fridge Attacks Return (SecurityWeek)
Related WaterISAC PIRs: 6-12