Malicious Cyber Activity Targeting Industrial Refrigeration and Cold Chain Monitoring Systems (Danfoss StoreView, Copeland/Dixell XWEB, Coolworld)

Key facts

Detection coverage

As of 2026-11-09, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5429 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Refrigeration Controller (Danfoss StoreView / Copeland XWEB) Default-Account or Known-IOC Login — TL-2026-5429

Detects successful logins to Danfoss StoreView AK-SM/AK-SC, Copeland/Dixell XWEB/XWEB Pro or CAREL pCOWeb management interfaces from the attacker IPs named in the Copeland XWEB Pro incident (198.251.85.67, 85.137.52.63) and the decoy-observed 188.208.141.210, or logins by a factory-default or generic admin account (Supervisor, Admin, Administrator, Dixell) from non-RFC1918 space between 00:00 and 05:00 UTC. ANSSI assessed default or shared contractor credentials on internet-exposed interfaces as the primary access path in the French supermarket wave, so this behaviour-first rule fires without relying on a CVE. Requires controller syslog/audit forwarded to Splunk.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1078.001, T1133, T1078
• Data sources: controller syslog (index=ot, sourcetype=syslog), firewall/VPN access logs
• Severity: high
• Confidence: high

Splunk SPL

index=ot sourcetype=syslog earliest=-24h ("XWEB" OR "StoreView" OR "AK-SM" OR "pCOWeb") ("login" OR "logged in" OR "authentication") ("success" OR "accepted")
| rex field=_raw "(?i)(?:user(?:name)?|account)[=:]\s*\W?(?<ctl_user>[A-Za-z0-9_.-]+)"
| rex field=_raw "(?i)(?:src|from|client|remote_addr)[=:\s]+(?<ctl_src>\d{1,3}(?:\.\d{1,3}){3})"
| eval hr=tonumber(strftime(_time,"%H"))
| eval ioc_ip=if(ctl_src IN ("198.251.85.67","85.137.52.63","188.208.141.210"),1,0)
| eval default_acct=if(match(ctl_user,"(?i)^(supervisor|admin|administrator|dixell)$"),1,0)
| eval external=if(cidrmatch("10.0.0.0/8",ctl_src) OR cidrmatch("172.16.0.0/12",ctl_src) OR cidrmatch("192.168.0.0/16",ctl_src),0,1)
| where ioc_ip=1 OR (default_acct=1 AND external=1 AND hr<5)
| stats count min(_time) AS first_seen max(_time) AS last_seen values(ctl_user) AS users BY host ctl_src ioc_ip
| convert ctime(first_seen) ctime(last_seen)
| eval threat_id="TL-2026-5429"

Microsoft KQL

Syslog
| where TimeGenerated > ago(24h)
| where SyslogMessage has_any ("XWEB", "StoreView", "AK-SM", "pCOWeb")
| where SyslogMessage has_any ("login", "logged in", "authentication") and SyslogMessage has_any ("success", "accepted")
| extend CtlUser = extract(@"(?i)(?:user(?:name)?|account)[=:]\s*\W?([A-Za-z0-9_.-]+)", 1, SyslogMessage), SrcIp = extract(@"(?i)(?:src|from|client|remote_addr)[=:\s]+(\d{1,3}(?:\.\d{1,3}){3})", 1, SyslogMessage)
| where SrcIp in ("198.251.85.67", "85.137.52.63", "188.208.141.210") or (CtlUser matches regex @"(?i)^(supervisor|admin|administrator|dixell)$" and hourofday(TimeGenerated) < 5 and not(ipv4_is_private(SrcIp)))
| project TimeGenerated, Computer, HostIP, CtlUser, SrcIp, SyslogMessage

Sigma

title: Refrigeration Controller Login With Factory-Default Account
id: 7c1d2e54-3a9b-4f6e-8d21-5b0a9c4e1f37
status: experimental
description: Detects successful logins to Danfoss StoreView, Copeland/Dixell XWEB or CAREL pCOWeb interfaces using the factory-default Supervisor or Administrator accounts. Default or shared credentials were the assessed primary access path in the 2026 European refrigeration sabotage campaign (TL-2026-5429).
references:
  - https://www.cisa.gov/resources-tools/resources/us-government-partners-urge-hardening-industrial-refrigeration-and-cold-chain-monitoring-systems
  - https://ransom-isac.org/blog/the-copeland-incident/
author: Threadlinqs Team
date: 2026-11-06
tags:
  - attack.initial-access
  - attack.persistence
  - attack.t1078.001
  - attack.t1133
  - cve.2026-21718
logsource:
  product: linux
  service: syslog
detection:
  keywords_controller:
    - 'XWEB'
    - 'StoreView'
    - 'AK-SM'
    - 'pCOWeb'
  keywords_login:
    - 'login success'
    - 'logged in'
    - 'authentication success'
    - 'accepted'
  keywords_default_user:
    - 'user=Supervisor'
    - 'username=Supervisor'
    - 'user: Supervisor'
    - 'user=Administrator'
    - 'username=Administrator'
    - 'user=Dixell'
  condition: keywords_controller and keywords_login and keywords_default_user
falsepositives:
  - Authorised engineers who still use the default account from the corporate network
  - Commissioning of a newly installed controller
level: high

Known false positives:

• Authorised maintenance engineer logging in with the default Supervisor/Administrator account during an out-of-hours call-out
• Initial commissioning of a new XWEB or StoreView controller before credentials are rotated

Tuning notes: Adjust index/sourcetype and the rex field names to match how your controller or syslog relay formats login events. The hour<5 test is UTC; shift it to local store time. Allowlist contractor egress IPs and approved maintenance windows. Ideally rotate default credentials so any default-account success is a true positive.

• 🔒 Defender for Endpoint: Connections to Refrigeration Controller Admin Interfaces From Known TL-2026-5429 IPs · unlock with TL Creds
• 🔒 Controller Alarm Muting, Keypad Lock and Defrost Activation Commands — Refrigeration Sabotage · unlock with TL Creds
• 🔒 Contractor or External Account Writing Controller Parameters Across Multiple Sites · unlock with TL Creds
• 🔒 Refrigeration Controller Default-Credential Login Attempts and Success — Sigma Primary · unlock with TL Creds
• 🔒 Refrigeration Controller Defrost Window Extended or Defrost Forced Overnight — Sigma Primary · unlock with TL Creds
• 🔒 Controller Admin Interface Reached From Hosting-Provider Infrastructure Linked To TL-2026-5429 — Sigma Primary · unlock with TL Creds
• 🔒 Bulk Refrigeration Controller Parameter Writes and Implausible Setpoints — TL-2026-5429 · unlock with TL Creds
• 🔒 External Source Reaching Multiple OT Controllers or Known TL-2026-5429 Attacker IP — Firewall · unlock with TL Creds

Indicators of compromise

As of 2026-11-09, Threadlinqs Intelligence tracks 26 indicators of compromise for TL-2026-5429.

Sample indicators (3 of 26)

• IP address: 198.251.85[.]67
• IP address: 85.137.52[.]63
• IP address: 188.208.141[.]210

Defanged, TLP:CLEAR. Full set of 26 indicators: unlock with TL Creds.

Technical analysis

On 2026-11-05 CISA, with the FBI, HHS, USDA and DOT, published a joint advisory warning that malicious actors are targeting electronic temperature controllers and commercial refrigeration controllers used in retail grocery, cold storage and refrigerated transport, across the healthcare and public health, chemical, food and agriculture, and transportation sectors. The advisory names authentication bypass, arbitrary code injection, weak configurations and exploitation of unpatched or internet-accessible controllers as the observed methods, and lists potential impacts of inventory loss, fire hazard from forced heating and defrost cycles, loss of temperature visibility (denial of view), equipment damage and consumer safety risk. It does not name CVEs, ports, device models or IOCs.

Press and third-party reporting fills in the incident chronology. A first wave on the night of 2026-10-11 hit about 700 of France's roughly 10,000 supermarkets through Danfoss StoreView (AK-SM/AK-SC) and Copeland/Dixell XWEB controllers, pushing setpoints to 50C or forcing prolonged defrost cycles; spoilage and equipment fires were reported. ANSSI warned of Danfoss compromises on 2026-10-14 and extended its advisory to Copeland/Dixell on 2026-10-15. A second wave on 2026-11-01/02 reportedly affected supermarkets in nine or more European countries using the same method. In a third incident on the night of 2026-11-01/02, an access path through Coolworld, a contractor of the Etablissement francais du sang (EFS), was used to change freezer setpoints at three EFS sites from about -30C to 110C; a technician intervened before product loss was reported.

A ransom-isac.org analysis of a Copeland XWEB Pro 1.9.0 incident on 2026-11-02 (03:10-03:44 UTC) shows two Administrator sessions, from 198.251.85.67 and 85.137.52.63. The first session ran parameter reconnaissance across 31 refrigeration devices, then performed 588 parameter writes across 26 devices. The second session performed 155 parameter writes across 5 cold rooms and issued commands. In total there were 743 parameter changes, setpoints of 110C and 150C, alarm muting, keypad locking and defrost activation, at a pace consistent with a script or bulk-programming function. The author states default-credential use required no vulnerability, and that the device ran a version affected by CVE-2026-21718 and CVE-2026-24663 (fixed in Copeland 1.13), but they have no evidence tying the incident to the France attacks.

The campaign is unattributed by the authorities. On 2026-11-04 Z-Pentest Alliance and NoName057(16) posted messages that were read as semi-claims; a substack analysis rates these as probably genuine channel material but without verifiable non-public detail, and rates the leading actor hypothesis at moderate confidence with copycat activity as the alternative. ANSSI reportedly assessed that the French wave abused weak, default or shared contractor credentials on internet-exposed administration interfaces. Related vulnerabilities in the product families include Danfoss AK-SM 8xxA CVE-2025-41450/41451/41452 (fixed in 4.3.1 per secondary reporting) and 23 Copeland XWEB/XWEB Pro flaws in CISA ICSA-26-057-10, but production exploitation of specific CVEs in the October and November waves is not confirmed in the sources. Exposure telemetry: Coalition counted 1,506 exposed Danfoss StoreView panels (54% in France) between Sept 7 and Oct 6; Forescout counted 12,976 exposed refrigeration management services in 99 countries; Censys reported a 53% reduction in exposed controllers after the incidents.

MITRE ATT&CK techniques by tactic:

Impact

T0826 Loss of Availability; T0828 Loss of Productivity and Revenue; T0831 Manipulation of Control; T0832 Manipulation of View; T0879 Damage to Property; T1565.001 Stored Data Manipulation

Impair Process Control

T0836 Modify Parameter; T0855 Unauthorized Command Message

persistence

T0859 Valid Accounts

Initial Access

T0883 Internet Accessible Device; T1078.001 Valid Accounts: Default Accounts; T1133 External Remote Services; T1190 Exploit Public-Facing Application; T1199 Trusted Relationship

Reconnaissance

T1595 Active Scanning; T1596.005 Search Open Technical Databases: Scan Databases

Remediation

Patches

• Copeland XWEB Pro: upgrade to 1.13 or later (CVE-2026-21718, CVE-2026-24663 affect 1.12.1 and prior)
• Danfoss AK-SM 8xxA: apply vendor fixed firmware per Danfoss/CISA advisories (secondary reporting cites 4.3.1 or later)
• Keep patched firewalls and edge devices for any remote access path

Immediate actions

• Remove direct public internet exposure of refrigeration controllers and supervisory HMIs (Danfoss StoreView AK-SM/AK-SC, Copeland/Dixell XWEB, Copeland Site Supervisor, CAREL pCOWeb)
• Change all default and shared credentials; issue named contractor accounts with phishing-resistant MFA and logging
• Audit setpoints, defrost schedules, alarm thresholds and user accounts against design values
• Deploy independent battery-backed temperature monitoring with SMS or phone escalation
• Restrict controller access by device/IP allowlisting and route remote access through patched VPN or secure gateway

Workarounds

• Where patching is not possible (e.g., end-of-life Danfoss AK-SM 800 and AK-SC 355), take the device off the internet and place behind VPN
• Define safe setpoint ranges and alert on out-of-range values and on defrost parameter changes outside maintenance windows

Longer-term hardening

• Isolate OT devices on a dedicated VLAN and segregate OT from business networks
• Implement lifecycle management and replace end-of-life controllers
• Enable logging and alerting on configuration changes, with safe setpoint ranges and alerts
• Maintain offline backups of controller configurations
• Rewrite maintenance contracts to require named credentials, logging and audit rights

Affected and fixed versions

• Danfoss — StoreView / AK-SM 800A and 8xxA series, AK-SM 800, AK-SC 355 system managers
  Vulnerable versions: AK-SM 8xxA before the fixed release (secondary reporting: below 4.3.1); AK-SM 800 (end-of-life, no patch); AK-SC 355 (phased out, no fix)
  Fixed in: AK-SM 800A 4.3.1 or later (secondary reporting)
• Copeland (Dixell brand) — XWEB / XWEB Pro (300D PRO, 500D PRO, 500B PRO), Site Supervisor, E3
  Vulnerable versions: XWEB Pro 1.12.1 and prior
  Fixed in: XWEB Pro 1.13
• CAREL — pCOWeb
  Vulnerable versions: Internet-exposed instances without HTTP authentication
• Coolworld — Refrigeration monitoring and maintenance services (contractor access to EFS cold rooms)
  Vulnerable versions: Contractor remote access to customer controllers

Timeline

Last updated 2026-11-09 · 2 updates · revalidated 2× · latest source

• 2024-06-01 Per the French report, the Shahid Kaveh unit has been able to scan, access and control Schneider Electric, Siemens and Rockwell ICS since at least June 2024.
• 2025-05-08 CVE-2025-41450 (Danfoss AK-SM 8xxA improper authentication, CVSS 8.2) published; CISA issued an advisory on AK-SM 8xxA vulnerabilities in May 2025
• 2026-02-27 NVD publishes CVE-2026-21718 (XWEB Pro authentication bypass) and CVE-2026-24663 (XWEB Pro unauthenticated OS command injection) for versions 1.12.1 and prior, following CISA's February 2026 advisory on 23 XWEB/XWEB Pro flaws
• 2026-04-07 US agencies (FBI, CISA, NSA, EPA, DOE, USCYBERCOM) publish a joint advisory on Iranian-affiliated actors disrupting internet-exposed PLCs (updated 22 July 2026); related activity, not confirmed as this campaign.
• 2026-10-11 Overnight wave hits about 700 French supermarkets via Danfoss and Copeland/Dixell controllers; setpoints raised to 50C or defrost cycles extended, causing spoilage and reported fires
• 2026-10-12 Paris prosecutor opens an investigation into the supermarket refrigeration attack; the case is later entrusted to the OFAC anti-cybercrime office.
• 2026-10-12 CERT-FR/ANSSI publishes alert CERTFR-2026-ALE-012 on compromises of remote refrigeration controllers (Copeland xweb, Danfoss AK-SC/AK-SM, Dixell xweb); Reuters reports Intermarche with 150 stores targeted. The alert lists no CVEs or IOCs.
• 2026-10-13 CERT-FR updates its alert with additional targeted equipment.
• 2026-10-14 France's ANSSI warns of Danfoss controller compromises
• 2026-10-15 Shadowserver, Censys and SecurityScorecard report thousands of exposed Danfoss and Copeland controllers (e.g. Shadowserver ~350 AK-SM 800A and 1,173 XWEB Pro/Evo; Censys >2,900 StoreView hosts).
• 2026-10-15 ANSSI extends its advisory to Copeland/Dixell; The Register reports researchers had warned of this attack scenario months earlier
• 2026-10-16 CERT-FR revises recommendations: remove Internet exposure, set Danfoss security level to Strict, change default passwords, and reset compromised devices (a reset alone does not prevent re-compromise).
• 2026-10-27 Decoy StoreView controller logs three default-credential login attempts from locked-ioc-1 (decoy logging ran Oct 20-30: 256 attempts from 91 sources)
• 2026-11-01 Second wave using the same method hits supermarkets in nine or more European countries on the night of Nov 1-2
• 2026-11-02 Via contractor Coolworld, freezer setpoints at three EFS (French National Blood Service) sites changed from about -30C to 110C; a Copeland XWEB Pro incident analyzed at 03:10-03:44 UTC shows 743 parameter writes from locked-ioc-2 and locked-ioc-3
• 2026-11-04 French Health Ministry confirms a cyberattack on several blood banks (Reuters, Le Monde); no operational consequences reported.
• 2026-11-04 Z-Pentest Alliance / NoName057(16)-branded posts appear implying credit for the attacks; no verifiable non-public detail and no confirmed attribution
• 2026-11-05 CISA, FBI, HHS, USDA and DOT publish joint advisory urging hardening of industrial refrigeration and cold chain monitoring systems; Censys later reports a 53% reduction in exposed controllers
• 2026-11-09 France's C4 publishes CERTFR-2026-CTI-009 and the Foreign Ministry formally attributes the October attack to Iran's IRGC-CEC Shahid Kaveh unit (CyberAv3ngers), announcing proposed new EU sanctions and the summoning of Iran's ambassador.

Update history

• 2026-11-09 — IRGC Shahid Kaveh (CyberAv3ngers) Sabotage of Refrigeration Controllers at 700+ French Supermarkets: What changed Attribution moves from Unattributed / Unknown / LOW confidence to Shahid Kaveh (CyberAv3ngers), Iran, motivation DESTRUCTION, HIGH confidence, on official French government attribution.
• 2026-11-09 — Attacks on Commercial Refrigeration and Cold-Chain Controllers (Danfoss AK-SM/AK-SC, Copeland XWEB, Dixell XWEB) Hit EU Supermarkets and French Blood Service Contractor; CISA/FBI/HHS/USDA/DOT Urge Hardening: What changed No change to severity, exploitability, status or attribution fields. The update adds the CERT-FR alert chronology (2026-10-12 to 10-16), the additional exposure telemetry, ICS technique mappings and CWE classes.

Sources cited

• US Government Partners Urge Hardening of Industrial Refrigeration and Cold Chain Monitoring Systems (CISA) CISA · Government advisory · 2026-11-05
• NVD - CVE-2026-21718 (Copeland XWEB Pro authentication bypass) NVD (NIST) · Advisory · 2026-02-27
• NVD - CVE-2026-24663 (Copeland XWEB Pro OS command injection) NVD (NIST) · Advisory · 2026-02-27
• NVD - CVE-2025-41450 (Danfoss AK-SM 8xxA improper authentication) NVD (NIST) · Advisory · 2025-05-08
• The Copeland Incident (ransom-isac.org) ransom-isac.org · Research
• The 2026 European Refrigeration Sabotage Campaign (cyberwarrior76 substack) cyberwarrior76.substack.com · Blog
• CISA, FBI Urge Action to Protect Industrial Refrigeration Networks (Infosecurity Magazine) infosecurity-magazine.com · News · 2026-11-06
• Researchers warned attackers could 'defrost the food' months before French supermarkets got hit (The Register) The Register · News · 2026-10-15

More in ics scada

• Copeland XWEB PRO refrigeration controllers abused for spam botnet, proxy/tunnel traffic and default-credential setpoint tampering (CVE-2026-25085 suspected entry point)
• Iranian-Affiliated Actors Exploit Internet-Exposed PLCs (Rockwell, Schneider, Siemens) in U.S. Critical Infrastructure (CISA AA26-097A)
• Second Wave of Attacks on European Supermarket Refrigeration Controllers (Danfoss AK-SM/AK-SC, Copeland/Dixell XWEB) Forces Defrost Mode
• CVE-2026-21656 - Johnson Controls Frick Controls Quantum HD Pre-Authentication Code Injection (CWE-94)
• Threat actors targeting internet-exposed PLCs in US water/wastewater sector causing lockouts, disconnections and boil water notices (CISA alert 2026-07-30; Iranian-affiliated PLC campaign AA26-097A)

Other reports on CVE-2026-21718

• Refrigeration controller attack in France: internet-exposed Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB controllers forced into defrost cycles at hundreds of grocery stores (CVE-2025-41450)
• CVE-2026-22877: Copeland XWEB / XWEB Pro Unauthenticated Arbitrary File Read (Path Traversal)
• CVE-2026-3037: OS Command Injection in Copeland XWEB Pro (MBird SMS service) enabling authenticated RCE