Skip to navigation

Threat reportICS/SCADATL-2026-5186

Second Wave of Attacks on European Supermarket Refrigeration Controllers (Danfoss AK-SM/AK-SC, Copeland/Dixell XWEB) Forces Defrost Mode

highACTIVE

Overnight into 2 November 2026 an unattributed actor remotely manipulated Internet-exposed refrigeration controllers at supermarkets in Belgium, Luxembourg, the Netherlands, Sweden, Estonia, Ireland and Finland (later reports add Portugal and Italy), forcing defrost cycles or raising setpoints to about 50 C and spoiling food.

Key facts for Supermarket fridge defrost attacks

IdentifiersTL-2026-5186, CVE-2025-41450, CVE-2025-41451, CVE-2025-41452
Also known as2026 European supermarket refrigerator hack, Fridge attacks
SeverityHIGH
First disclosed
Exploitation statusExploited in the wild
EPSSCVE-2025-41451: 4.4% (91.4th percentile); CVE-2025-41450: 0.9% (61.2th percentile); CVE-2025-41452: 0.9% (60.4th percentile)
Affected productsDanfoss AK-SM 800A; Danfoss AK-SM 800 / AK-SC 355 (end of life); Copeland XWEB / XWEB Pro; Dixell (Copeland brand) XWEB
Weaknesses (CWE)CWE-77, CWE-15, CWE-259, CWE-306
MITRE ATT&CK techniquesT0813 Denial of Control, T0822 External Remote Services, T0826 Loss of Availability, T0828 Loss of Productivity and Revenue, T0831 Manipulation of Control, T0836 Modify Parameter, T0855 Unauthorized Command Message, T0859 Valid Accounts, T0879 Damage to Property, T0883 Internet Accessible Device, T0886 Remote Services, T1078 Valid Accounts and 3 more in the attack flow
MotivationUNKNOWN
Target sectorsretail, food and grocery, cold chain, logistics
Target regionsEurope, belgium, luxembourg, netherlands, sweden, estonia, ireland, finland, portugal, italy, france
Detection rules9 (1 shown free)
Sources13 cited sources

Detection coverage for Supermarket fridge defrost attacks

As of 2026-11-05, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5186 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB Default Admin Login from Internet (Exploitation)

Detects Internet-sourced authentication activity against refrigeration controller web interfaces (Danfoss AK-SM 800A, AK-SM 800, AK-SC 355, Copeland/Dixell XWEB) that shows either repeated failed logons or a successful logon as 'admin'. Lupovis decoys logged 256 attempts from 91 sources, mostly factory-default credentials, and the 2026 waves are reported to use admin plus a default or date-derived password (T1078.001, T0859). No CVE is confirmed as the vector, so this keys on behaviour rather than an exploit string.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1190, T1078.001, T0859
  • Data sources: web:access_combined, reverse_proxy_access_logs, CommonSecurityLog
  • Severity: high
  • Confidence: high

Splunk SPL

index=web sourcetype=access_combined (host="*ak-sm*" OR host="*ak-sc*" OR host="*xweb*" OR host="*danfoss*" OR host="*dixell*") (uri_path="*login*" OR uri_path="*auth*" OR uri_path="*session*")
```comment: TL-2026-5186 Internet-sourced logons to Danfoss AK-SM/AK-SC or Copeland/Dixell XWEB; flags brute force or a successful admin default-credential logon```
| where NOT (cidrmatch("10.0.0.0/8",clientip) OR cidrmatch("172.16.0.0/12",clientip) OR cidrmatch("192.168.0.0/16",clientip))
| eval failed=if(status==401 OR status==403,1,0), success=if(status>=200 AND status<400,1,0), is_admin=if(lower(user)=="admin",1,0)
| stats count AS attempts sum(failed) AS failures sum(success) AS successes sum(is_admin) AS admin_attempts min(_time) AS first_seen max(_time) AS last_seen BY clientip host
| where failures>=5 OR (admin_attempts>0 AND successes>0)
| eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T")
| table clientip host attempts failures successes admin_attempts first_seen last_seen

Microsoft KQL

CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DestinationHostName matches regex '(?i)(ak-?sm|ak-?sc|xweb|danfoss|dixell)'
| where RequestURL has_any ('login', 'auth', 'session')
| where not(ipv4_is_private(SourceIP))
| summarize Attempts = count(), AdminSeen = countif(SourceUserName =~ 'admin'), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationHostName, bin(TimeGenerated, 1h)
| where Attempts >= 5 or AdminSeen > 0
| project FirstSeen, LastSeen, SourceIP, DestinationHostName, Attempts, AdminSeen

Sigma

title: Refrigeration Controller Login as Admin from External Address
id: 5b1c7a52-0a8e-4c0e-9a41-6f2d3c1e8a01
status: experimental
description: Detects logon requests as admin against Danfoss AK-SM/AK-SC or Copeland/Dixell XWEB web interfaces from non-RFC1918 sources, consistent with default-credential abuse in the 2026 European supermarket refrigeration attacks (TL-2026-5186).
references:
    - https://claroty.com/team82/research/freeze-the-controller-defrost-the-food-uncovering-vulnerabilities-in-danfoss-refrigeration-controllers
    - https://www.danfoss.com/en/service-and-support/coordinated-vulnerability-disclosure/danfoss-security-advisories/dsa-2025-08-01/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/03
tags:
    - attack.initial-access
    - attack.t1078.001
    - attack.t1190
    - attack.t0859
logsource:
    category: webserver
detection:
    selection_host:
        cs-host|contains:
            - 'ak-sm'
            - 'ak-sc'
            - 'xweb'
            - 'danfoss'
            - 'dixell'
    selection_login:
        c-uri|contains:
            - 'login'
            - 'auth'
            - 'session'
        cs-username: 'admin'
    filter_internal:
        c-ip|cidr:
            - '10.0.0.0/8'
            - '172.16.0.0/12'
            - '192.168.0.0/16'
    condition: selection_host and selection_login and not filter_internal
falsepositives:
    - Authorised integrator or contractor administering controllers from a known public address
    - External vulnerability scanners
level: high

Known false positives:

  • Authorised refrigeration integrators (for example Sabcobel) or vendor staff logging in from known public IP ranges
  • Internal security scanners or monitoring probes hitting login URLs from a routable address

Tuning notes: Adjust the host patterns to your controller naming or replace them with a controller subnet or asset lookup. Allowlist contractor and VPN egress addresses. Lower the failure threshold of 5 for controllers that should never face the Internet, where any external logon should alert.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Command Injection Metacharacters in Controller Alarm-to-Mail or [indicator] Requests (CVE-2025-41451/41452) · unlock with TL Creds
  • Forced or Extended Defrost Cycles on Refrigeration Controllers (Post-Exploitation) · unlock with TL Creds
  • Single Source Authenticating to Many Refrigeration Controllers (Mass Manipulation / Lateral Movement) · unlock with TL Creds
  • Internet Access to Refrigeration Controller Management Interface (Exposed Service) · unlock with TL Creds
  • Refrigeration Controller Alarm Suppression, Credential or Lock Changes · unlock with TL Creds
  • Refrigeration Controller DNS Lookup of GitHub or Raw Content Hosts (Tool Staging) · unlock with TL Creds
  • Refrigeration Controller Setpoint Raised to 40 C or Higher (Post-Exploitation) · unlock with TL Creds
  • Refrigeration Controller Outbound Connection to the Internet (C2 / Tool Transfer) · unlock with TL Creds

Indicators of compromise for Supermarket fridge defrost attacks

As of 2026-11-05, Threadlinqs Intelligence tracks 15 indicators of compromise for TL-2026-5186.

Sample indicators (1 of 15)

  • URL: hxxps://github[.]com/msuiche/fromagegate

Defanged, TLP:CLEAR. Full set of 15 indicators: unlock with TL Creds.

15 indicators of compromise · unlock with TL Creds. Compare plans

How Supermarket fridge defrost attacks works

It followed a first wave on 11 October 2026 that hit up to 700 French stores; no CVE has been confirmed as the vector, and reports point to default credentials, end-of-life units and direct Internet exposure.

On the night of 1-2 November 2026, supermarket chains in at least seven European countries found refrigeration units in defrost mode or with setpoints raised to roughly 50 C (122 F). Reported affected retailers include Ahold Delhaize (about 40 sites in Belgium and Luxembourg), Carrefour Belgium (15 of 700+ stores), Colruyt/Spar, Intermarche, IKEA Belgium, ICA and Coop in Sweden, SuperValu/Musgrave in Ireland (13 of 223 stores), Selver in Estonia, Kesko in Finland and 17+ small Dutch shops. BleepingComputer counted 115+ confirmed stores. Follow-on reporting adds Portugal and Italy. Attackers also locked settings so staff could not change them manually, and in one case shut units down. Stores had to move stock to refrigerated trucks. One Belgian butcher reported about EUR 15,000 of spoiled meat.

The campaign follows a first wave on 11-12 October 2026 against up to roughly 700 French supermarkets, with reported losses above EUR 10 million. CERT-FR alert CERTFR-2026-ALE-012 named Danfoss AK-SM/AK-SC controllers and Copeland/Dixell XWEB supervisory controllers. Danfoss told customers on 13 October to disconnect systems from the Internet, and Copeland/Dixell XWEB was added to the alert the same day. Investigators have not publicly confirmed that the two waves are linked. No group has claimed responsibility, and Belgium's Centre for Cybersecurity said the actor may never be identified.

Initial access is not tied to a specific CVE in any source reviewed. Evidence points to basic weaknesses: web servers reachable on the public Internet, factory-default or trivial credentials without MFA (Sweden NCSC), no IP filtering or segmentation, outdated firmware, and end-of-life models (Danfoss AK-SC 355, end of life 2016; AK-SM 800, May 2021). Lupovis decoy Danfoss controllers logged 256 attempts from 91 sources between 20 and 30 October 2026, peaking on 26 October. Most used publicly documented factory-default credentials. The UK NCSC said the attackers did not use AI and relied on long-known weaknesses.

Related prior research by Claroty Team82 on the Danfoss AK-SM 800A documents an undocumented 'code of the day' authentication path (function check_code_of_day), where a password is derived from the device's current date. This is tracked as CVE-2025-41450 (fixed in 4.2, DSA-2025-03-01, 24 March 2025). The same research documents authenticated command injection via alarm-to-mail fields (CVE-2025-41451) and Nginx headers.conf control (CVE-2025-41452), both fixed in R4.3.1 (DSA-2025-08-01, August 2025). Press and Wikipedia describe the 2026 intrusions as using 'admin' plus the date as password, but no primary source confirms that these CVEs were the actual vector. Claroty found 2,765 exposed AK-SM 800A devices via Censys, and Wikipedia cites about 4,500 vulnerable Danfoss controllers still online after the incident. Sabcobel, a Belgian refrigeration integrator, said the same vulnerability was used in the French and Belgian incidents and that most clients have since moved to secure interconnections. Physical impact in the first wave included temperatures above 80 C, melted equipment and fire.

Defensive priorities: remove controllers from the public Internet and cellular exposure, allow remote access only through VPN, enable MFA where supported, change default credentials, set Danfoss security level to Strict, patch AK-SM 8xxA to R4.3.1 or later, and replace end-of-life AK-SM 800 and AK-SC 355 units. Monitor for unscheduled defrost cycles (reported around 01:00-02:00 local), abnormal setpoints, defrost durations stretched from one hour to as many as eight, suppressed alarms, and sessions from unknown IP ranges. No network IOCs have been published, so BeaconBeagle correlation was not applicable.

MITRE ATT&CK techniques by tactic:

Impact

T0813 Denial of Control; T0826 Loss of Availability; T0828 Loss of Productivity and Revenue; T0831 Manipulation of Control; T0879 Damage to Property

Initial Access

T0822 External Remote Services; T0883 Internet Accessible Device; T1078.001 Valid Accounts: Default Accounts; T1133 External Remote Services; T1190 Exploit Public-Facing Application

Impair Process Control

T0836 Modify Parameter; T0855 Unauthorized Command Message

persistence

T0859 Valid Accounts

Lateral Movement

T0886 Remote Services

Defense Evasion

T1078 Valid Accounts

Remediation for Supermarket fridge defrost attacks

Patches

  • Danfoss AK-SM 8xxA firmware R4.3.1 or later (DSA-2025-08-01; CVE-2025-41450 fixed in 4.2 per DSA-2025-03-01)
  • Apply the latest Copeland XWEB Pro firmware per vendor guidance

Immediate actions

  • Disconnect refrigeration controllers (Danfoss AK-SM/AK-SC, Copeland/Dixell XWEB) from the public Internet and cellular exposure
  • Restore remote access only through a secure VPN; temporarily filter contractor IP addresses at the firewall
  • Change all default passwords and enable MFA where supported
  • Audit defrost schedules, setpoints and alarm escalation paths for unauthorized changes

Workarounds

  • Set the Danfoss security level to Strict
  • Place management interfaces on trusted management networks or VPN only

Longer-term hardening

  • Replace end-of-life Danfoss AK-SM 800 and AK-SC 355 units that no longer receive security updates
  • Segment refrigeration and building-management networks from corporate networks
  • Validate integrator and vendor claims on patching, segmentation and incident response
  • Alert on unscheduled defrost cycles and abnormal setpoints, with independent temperature sensors and alarms

Affected and fixed versions

  • Danfoss — AK-SM 800A
    Vulnerable versions: prior to R4.3.1
    Fixed in: R4.3.1 or later
  • Danfoss — AK-SM 800 / AK-SC 355 (end of life)
    Vulnerable versions: all versions; no longer supported
  • Copeland — XWEB / XWEB Pro
    Vulnerable versions: internet-exposed or default-credential deployments named in CERT-FR alert
    Fixed in: latest vendor firmware
  • Dixell (Copeland brand) — XWEB
    Vulnerable versions: internet-exposed or default-credential deployments named in CERT-FR alert
    Fixed in: latest vendor firmware

Timeline of Supermarket fridge defrost attacks

Last updated · revalidated 1× · latest source

  • Danfoss publishes DSA-2025-03-01 following Claroty Team82 research; CVE-2025-41450 (code-of-the-day authentication bypass) fixed in AK-SM 800A version 4.2
  • Danfoss publishes DSA-2025-08-01; CVE-2025-41451 and CVE-2025-41452 fixed in AK-SM 8xxA R4.3.1
  • August 2026 (exact day not stated): freezers at U.S. military commissaries reported malfunctioning or switched into defrost/heating modes; the Pentagon is reported to be investigating suspected attacks.
  • First wave: up to roughly 700 French supermarkets have refrigeration controllers set to defrost overnight
  • CERT-FR alert CERTFR-2026-ALE-012 names Danfoss AK-SM/AK-SC controllers
  • Overnight 12-13 October: setpoints raised to about 50 C for roughly six hours at up to about 700 French stores, with spillover reported in Belgium, Germany, the Netherlands, Poland, Portugal and Spain; three French blood bank facilities also reported tampered cooling units.
  • Danfoss advises customers to disconnect systems from the Internet; Copeland/locked-ioc-15 added to the CERT-FR alert
  • Lupovis decoy Danfoss controllers begin logging attacks; 256 attempts from 91 sources through 30 October, peaking 26 October, mostly with documented factory-default credentials
  • Second wave overnight into Monday: stores in Belgium, Luxembourg, Netherlands, Sweden, Estonia, Ireland and Finland (later also Portugal and Italy) report defrost mode, setpoints raised to about 50 C and locked settings
  • Belgian and Swedish authorities comment; Belgium's Centre for Cybersecurity says the perpetrator may never be identified; no group claims responsibility
  • CISA, the FBI and partners urge critical infrastructure operators to harden industrial refrigeration and cold-chain monitoring systems: identify internet-accessible systems, remove unnecessary remote access, secure required access, enforce strong authentication and patch.

Update history

Sources cited for Supermarket fridge defrost attacks

Drafted by the Threadlinqs research pipeline from 13 sources; published ; last updated .

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats