Internet-exposed refrigeration controllers used in supermarkets and cold storage facilities are being hijacked and turned into infrastructure for a suspected spam botnet and proxy services, SecurityScorecard has found. The report follows a string of attacks against European refrigeration systems, which Help Net Security started covering in October, when hundreds of French supermarkets had to throw […]
Internet-exposed refrigeration controllers used in supermarkets and cold storage facilities are being hijacked and turned into infrastructure for a suspected spam botnet and proxy services, SecurityScorecard has found.
The report follows a string of attacks against European refrigeration systems, which Help Net Security started covering in October, when hundreds of French supermarkets had to throw out spoiled stock after attackers took over the systems running their fridges and freezers overnight and switched them to heating.
About three weeks later, another wave hit stores in Belgium, Luxembourg and Sweden, and subsequent reports added Finland, Ireland, Estonia and the Netherlands.
Last week, the French Blood Establishment (EFS) confirmed that cold rooms at three of its blood banks registered a temperature spike after one of its refrigeration equipment providers was compromised.
The controllers SecurityScorecard tracked through internet scan data and network traffic are Copeland XWEB PRO units, originally made by Dixell, which run the freezer and chiller racks in supermarkets and let technicians check temperatures and change settings from afar. Copeland and Dixell controllers, along with Danfoss equipment, were also targeted in the October attacks on French supermarkets, Ransom-ISAC noted in a separate report.
“Refrigeration control software is internet-connected but often goes without security updates, either because updates require taking equipment offline or because the risk is overlooked,” researchers stated.
A botnet built partly from fridges
SecurityScorecard’s STRIKE threat intelligence team started with internet scan data, filtered it down to genuine XWEB controllers, and then looked at network traffic coming from the exposed panels.
Nine IP addresses, first spotted on November 2, stood out because they sent outgoing email while receiving none, which is not something a legitimate mail server does. Three of the nine turned out to be XWEB controllers, confirmed through their TLS certificates or the title of their web interface.
The three busiest nodes shared about 47% of their email targets, and 508 of the 1,041 targets were hit by two or more nodes. “Independent spammers would not converge on the same victims by chance,” the STRIKE team wrote, adding that the overlap suggests a single coordinated operator. SecurityScorecard found only weak signs of shared command and control (C2) infrastructure.
Two other controllers had been put to different uses. One, on a network in Namibia, was working as a tunnel gateway and carried 71% of all the traffic in the captured data. Another, in Trinidad and Tobago, connected to 10,643 different hosts in 17 hours, behaving like a residential proxy exit point.
SecurityScorecard believes the attackers most likely got in through CVE-2026-25085, a flaw in the controller’s login check that lets an unauthenticated user past the password prompt. It is one of 23 vulnerabilities Claroty Team82 reported to CISA, which published an advisory about them in February.
Once attackers can reach it, the controller is a small Linux computer with a stable IP address that no security team watches or logs, so it can be abused for weeks or months without anyone noticing, the company explained.
“STRIKE’s overall confidence is low to medium. Device behavior and the SMTP coordination are well supported, but full device attribution and the C2 picture are still under investigation. When taking action, treat these IPs as victims or abused infrastructure, not as adversary-owned assets,” researchers concluded.
SecurityScorecard has not linked its botnet findings to the attacks in France or elsewhere in Europe.
Same night, no proven link
A day after SecurityScorecard’s report came out, Ransom-ISAC published an analysis of an attack on another internet-exposed XWEB Pro controller, at a commercial refrigeration site whose name was withheld.
In the early hours of November 2, two Administrator sessions coming from IP addresses in Australia and the Netherlands read the settings of 31 devices and then made 743 changes, including setpoints of 110°C and 150°C, and sent commands to mute alarms and lock local keypads.
“The attackers needed no vulnerability, only the default credentials,” Massimo Giaimo wrote, since the controller still used the factory Administrator login. The event log can’t show which temperatures the equipment reached or whether any food was lost, the report notes.
The attack Ransom-ISAC analyzed happened on the same night the EFS blood banks were hit. Pro-Russian groups NoName057(16) and Z-Pentest claimed the supermarket attacks on November 4, but investigators haven’t confirmed the claim or tied the blood bank incident to the supermarket ones.
Ransom-ISAC says it has no evidence connecting its incident to those groups or to the French attacks. The settings changes look similar, with setpoints pushed to 110°C and defrost cycles tampered with, but anyone with administrative access to a controller could make them, they explained.
“This campaign matters because attackers caused physical damage with the normal control functions of refrigeration systems, with no ransom demand and no known malware. Thousands of these controllers are still open to the internet, and third parties that manage them remotely often do not install the necessary updates,” Ransom-ISAC warned.
