# Second Wave of Attacks on European Supermarket Refrigeration Controllers (Danfoss AK-SM/AK-SC, Copeland/Dixell XWEB) Forces Defrost Mode

> Overnight into 2 November 2026 an unattributed actor remotely manipulated Internet-exposed refrigeration controllers at supermarkets in Belgium, Luxembourg, the Netherlands, Sweden, Estonia, Ireland and Finland (later reports add Portugal and Italy), forcing defrost cycles or raising setpoints to about 50 C and spoiling food. It followed a first wave on 11 October 2026 that hit up to 700 French stores; no CVE has been confirmed as the vector, and reports point to default credentials, end-of-life units and direct Internet exposure.

- **Published:** 2026-11-03T23:17:46Z
- **Last reviewed:** 2026-11-05T19:53:44.771Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5186
- **ID:** TL-2026-5186
- **Severity:** HIGH
- **Category:** ICS_SCADA
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 15 (1 shown free below)
- **CVEs:** CVE-2025-41450, CVE-2025-41451, CVE-2025-41452

## Description

On the night of 1-2 November 2026, supermarket chains in at least seven European countries found refrigeration units in defrost mode or with setpoints raised to roughly 50 C (122 F). Reported affected retailers include Ahold Delhaize (about 40 sites in Belgium and Luxembourg), Carrefour Belgium (15 of 700+ stores), Colruyt/Spar, Intermarche, IKEA Belgium, ICA and Coop in Sweden, SuperValu/Musgrave in Ireland (13 of 223 stores), Selver in Estonia, Kesko in Finland and 17+ small Dutch shops. BleepingComputer counted 115+ confirmed stores. Follow-on reporting adds Portugal and Italy. Attackers also locked settings so staff could not change them manually, and in one case shut units down. Stores had to move stock to refrigerated trucks. One Belgian butcher reported about EUR 15,000 of spoiled meat.

The campaign follows a first wave on 11-12 October 2026 against up to roughly 700 French supermarkets, with reported losses above EUR 10 million. CERT-FR alert CERTFR-2026-ALE-012 named Danfoss AK-SM/AK-SC controllers and Copeland/Dixell XWEB supervisory controllers. Danfoss told customers on 13 October to disconnect systems from the Internet, and Copeland/Dixell XWEB was added to the alert the same day. Investigators have not publicly confirmed that the two waves are linked. No group has claimed responsibility, and Belgium's Centre for Cybersecurity said the actor may never be identified.

Initial access is not tied to a specific CVE in any source reviewed. Evidence points to basic weaknesses: web servers reachable on the public Internet, factory-default or trivial credentials without MFA (Sweden NCSC), no IP filtering or segmentation, outdated firmware, and end-of-life models (Danfoss AK-SC 355, end of life 2016; AK-SM 800, May 2021). Lupovis decoy Danfoss controllers logged 256 attempts from 91 sources between 20 and 30 October 2026, peaking on 26 October. Most used publicly documented factory-default credentials. The UK NCSC said the attackers did not use AI and relied on long-known weaknesses.

Related prior research by Claroty Team82 on the Danfoss AK-SM 800A documents an undocumented 'code of the day' authentication path (function check_code_of_day), where a password is derived from the device's current date. This is tracked as CVE-2025-41450 (fixed in 4.2, DSA-2025-03-01, 24 March 2025). The same research documents authenticated command injection via alarm-to-mail fields (CVE-2025-41451) and Nginx headers.conf control (CVE-2025-41452), both fixed in R4.3.1 (DSA-2025-08-01, August 2025). Press and Wikipedia describe the 2026 intrusions as using 'admin' plus the date as password, but no primary source confirms that these CVEs were the actual vector. Claroty found 2,765 exposed AK-SM 800A devices via Censys, and Wikipedia cites about 4,500 vulnerable Danfoss controllers still online after the incident. Sabcobel, a Belgian refrigeration integrator, said the same vulnerability was used in the French and Belgian incidents and that most clients have since moved to secure interconnections. Physical impact in the first wave included temperatures above 80 C, melted equipment and fire.

Defensive priorities: remove controllers from the public Internet and cellular exposure, allow remote access only through VPN, enable MFA where supported, change default credentials, set Danfoss security level to Strict, patch AK-SM 8xxA to R4.3.1 or later, and replace end-of-life AK-SM 800 and AK-SC 355 units. Monitor for unscheduled defrost cycles (reported around 01:00-02:00 local), abnormal setpoints, defrost durations stretched from one hour to as many as eight, suppressed alarms, and sessions from unknown IP ranges. No network IOCs have been published, so BeaconBeagle correlation was not applicable.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078.001 Valid Accounts: Default Accounts
- T0859 Valid Accounts
- T0883 Internet Accessible Device
- T0822 External Remote Services
- T0886 Remote Services
- T0836 Modify Parameter
- T0855 Unauthorized Command Message
- T0831 Manipulation of Control
- T0813 Denial of Control
- T0826 Loss of Availability
- T0828 Loss of Productivity and Revenue
- T0879 Damage to Property
- T1133 External Remote Services
- T1078 Valid Accounts

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB Default Admin Login from Internet (Exploitation)** (`TL-2026-5186-SPL-001`)

Detects Internet-sourced authentication activity against refrigeration controller web interfaces (Danfoss AK-SM 800A, AK-SM 800, AK-SC 355, Copeland/Dixell XWEB) that shows either repeated failed logons or a successful logon as 'admin'. Lupovis decoys logged 256 attempts from 91 sources, mostly factory-default credentials, and the 2026 waves are reported to use admin plus a default or date-derived password (T1078.001, T0859). No CVE is confirmed as the vector, so this keys on behaviour rather than an exploit string.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1078.001, T0859
- **Data sources:** web:access_combined, reverse_proxy_access_logs, CommonSecurityLog
- **Severity:** high
- **Confidence:** high

### Splunk SPL

````spl
index=web sourcetype=access_combined (host="*ak-sm*" OR host="*ak-sc*" OR host="*xweb*" OR host="*danfoss*" OR host="*dixell*") (uri_path="*login*" OR uri_path="*auth*" OR uri_path="*session*")
```comment: TL-2026-5186 Internet-sourced logons to Danfoss AK-SM/AK-SC or Copeland/Dixell XWEB; flags brute force or a successful admin default-credential logon```
| where NOT (cidrmatch("10.0.0.0/8",clientip) OR cidrmatch("172.16.0.0/12",clientip) OR cidrmatch("192.168.0.0/16",clientip))
| eval failed=if(status==401 OR status==403,1,0), success=if(status>=200 AND status<400,1,0), is_admin=if(lower(user)=="admin",1,0)
| stats count AS attempts sum(failed) AS failures sum(success) AS successes sum(is_admin) AS admin_attempts min(_time) AS first_seen max(_time) AS last_seen BY clientip host
| where failures>=5 OR (admin_attempts>0 AND successes>0)
| eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T")
| table clientip host attempts failures successes admin_attempts first_seen last_seen
````

### Microsoft KQL

```kql
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DestinationHostName matches regex '(?i)(ak-?sm|ak-?sc|xweb|danfoss|dixell)'
| where RequestURL has_any ('login', 'auth', 'session')
| where not(ipv4_is_private(SourceIP))
| summarize Attempts = count(), AdminSeen = countif(SourceUserName =~ 'admin'), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationHostName, bin(TimeGenerated, 1h)
| where Attempts >= 5 or AdminSeen > 0
| project FirstSeen, LastSeen, SourceIP, DestinationHostName, Attempts, AdminSeen
```

### Sigma

```yaml
title: Refrigeration Controller Login as Admin from External Address
id: 5b1c7a52-0a8e-4c0e-9a41-6f2d3c1e8a01
status: experimental
description: Detects logon requests as admin against Danfoss AK-SM/AK-SC or Copeland/Dixell XWEB web interfaces from non-RFC1918 sources, consistent with default-credential abuse in the 2026 European supermarket refrigeration attacks (TL-2026-5186).
references:
    - https://claroty.com/team82/research/freeze-the-controller-defrost-the-food-uncovering-vulnerabilities-in-danfoss-refrigeration-controllers
    - https://www.danfoss.com/en/service-and-support/coordinated-vulnerability-disclosure/danfoss-security-advisories/dsa-2025-08-01/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/03
tags:
    - attack.initial-access
    - attack.t1078.001
    - attack.t1190
    - attack.t0859
logsource:
    category: webserver
detection:
    selection_host:
        cs-host|contains:
            - 'ak-sm'
            - 'ak-sc'
            - 'xweb'
            - 'danfoss'
            - 'dixell'
    selection_login:
        c-uri|contains:
            - 'login'
            - 'auth'
            - 'session'
        cs-username: 'admin'
    filter_internal:
        c-ip|cidr:
            - '10.0.0.0/8'
            - '172.16.0.0/12'
            - '192.168.0.0/16'
    condition: selection_host and selection_login and not filter_internal
falsepositives:
    - Authorised integrator or contractor administering controllers from a known public address
    - External vulnerability scanners
level: high
```

**Known false positives:**

- Authorised refrigeration integrators (for example Sabcobel) or vendor staff logging in from known public IP ranges
- Internal security scanners or monitoring probes hitting login URLs from a routable address

**Tuning notes:** Adjust the host patterns to your controller naming or replace them with a controller subnet or asset lookup. Allowlist contractor and VPN egress addresses. Lower the failure threshold of 5 for controllers that should never face the Internet, where any external logon should alert.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Command Injection Metacharacters in Controller Alarm-to-Mail or [indicator] Requests (CVE-2025-41451/41452) (locked: unlock with TL Creds)
- Forced or Extended Defrost Cycles on Refrigeration Controllers (Post-Exploitation) (locked: unlock with TL Creds)
- Single Source Authenticating to Many Refrigeration Controllers (Mass Manipulation / Lateral Movement) (locked: unlock with TL Creds)
- Internet Access to Refrigeration Controller Management Interface (Exposed Service) (locked: unlock with TL Creds)
- Refrigeration Controller Alarm Suppression, Credential or Lock Changes (locked: unlock with TL Creds)
- Refrigeration Controller DNS Lookup of GitHub or Raw Content Hosts (Tool Staging) (locked: unlock with TL Creds)
- Refrigeration Controller Setpoint Raised to 40 C or Higher (Post-Exploitation) (locked: unlock with TL Creds)
- Refrigeration Controller Outbound Connection to the Internet (C2 / Tool Transfer) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (1 of 15)

Defanged, TLP:CLEAR.

- URL: `hxxps://github[.]com/msuiche/fromagegate`

Full set of 15 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Fresh European Fridge Attacks Put Cold Chain Security in Focus](https://www.darkreading.com/ics-ot-security/fresh-european-fridge-attacks-cold-chain-security)
- [EU Grocers Pay a Steep Price for Unpatched Fridge Firmware](https://www.darkreading.com/ics-ot-security/eu-grocers-unpatched-fridge-firmware)
- [New Wave of Refrigeration Cyberattacks Hits Supermarkets Across Europe, Forcing Stores to Pull Food](https://thehackernews.com/2026/11/second-wave-of-cyberattacks-hits.html)
- [Hackers disrupt refrigeration systems at European supermarkets](https://www.bleepingcomputer.com/news/security/hackers-disrupt-refrigeration-systems-at-european-supermarkets/)
- [2026 French supermarket refrigerator hack](https://en.wikipedia.org/wiki/2026_French_supermarket_refrigerator_hack)
- [Europe Supermarket Refrigeration Cyberattacks: What Retailers and Cold-Chain Vendors Should Do Now](https://www.rescana.com/post/europe-supermarket-refrigeration-cyberattack-ot-prepare-now)
- [Hackers hit supermarket fridges across Europe again, three weeks after France](https://www.marketscale.com/industries/retail/supermarket-fridge-cyberattacks-spread-across-europe)
- [Supermarket hacking spree hits second refrigeration supplier](https://cybernews.com/security/copeland-dixell-cyberattack-french-supermarket-refrigeration/)
- [Claroty Team82: Freeze the Controller, Defrost the Food - Vulnerabilities in Danfoss Refrigeration Controllers](https://claroty.com/team82/research/freeze-the-controller-defrost-the-food-uncovering-vulnerabilities-in-danfoss-refrigeration-controllers)
- [Danfoss Security Advisory DSA-2025-08-01](https://www.danfoss.com/en/service-and-support/coordinated-vulnerability-disclosure/danfoss-security-advisories/dsa-2025-08-01/)
- [NVD CVE-2025-41451](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2025-41451)
- [NVD CVE-2025-41452](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2025-41452)
- [fromagegate PoC repository (referenced by NVD)](https://github.com/msuiche/fromagegate)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5186