# Malicious Cyber Activity Targeting Industrial Refrigeration and Cold Chain Monitoring Systems (Danfoss StoreView, Copeland/Dixell XWEB, Coolworld) > CISA, the FBI, HHS, USDA and DOT warn of malicious activity against internet-exposed industrial refrigeration and cold chain controllers, where attackers remotely alter setpoints and defrost schedules. Incidents include roughly 700 French supermarkets (Oct 11, 2026), over 100 stores across multiple European countries (Nov 1-2, 2026) and the French National Blood Service (EFS) via contractor Coolworld, where freezer setpoints were changed from -30C to 110C. - **Published:** 2026-11-06T16:36:43Z - **Last reviewed:** 2026-11-09T22:57:05.340Z - **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5429 - **ID:** TL-2026-5429 - **Severity:** CRITICAL - **Category:** ICS_SCADA - **Status:** ACTIVE - **Actor:** Shahid Kaveh (Iran) - **Detections:** 9 (1 shown free below) · **IOCs:** 26 (3 shown free below) - **CVEs:** CVE-2026-21718, CVE-2026-24663, CVE-2026-25085, CVE-2025-41450, CVE-2025-41451, CVE-2025-41452 ## Description On 2026-11-05 CISA, with the FBI, HHS, USDA and DOT, published a joint advisory warning that malicious actors are targeting electronic temperature controllers and commercial refrigeration controllers used in retail grocery, cold storage and refrigerated transport, across the healthcare and public health, chemical, food and agriculture, and transportation sectors. The advisory names authentication bypass, arbitrary code injection, weak configurations and exploitation of unpatched or internet-accessible controllers as the observed methods, and lists potential impacts of inventory loss, fire hazard from forced heating and defrost cycles, loss of temperature visibility (denial of view), equipment damage and consumer safety risk. It does not name CVEs, ports, device models or IOCs. Press and third-party reporting fills in the incident chronology. A first wave on the night of 2026-10-11 hit about 700 of France's roughly 10,000 supermarkets through Danfoss StoreView (AK-SM/AK-SC) and Copeland/Dixell XWEB controllers, pushing setpoints to 50C or forcing prolonged defrost cycles; spoilage and equipment fires were reported. ANSSI warned of Danfoss compromises on 2026-10-14 and extended its advisory to Copeland/Dixell on 2026-10-15. A second wave on 2026-11-01/02 reportedly affected supermarkets in nine or more European countries using the same method. In a third incident on the night of 2026-11-01/02, an access path through Coolworld, a contractor of the Etablissement francais du sang (EFS), was used to change freezer setpoints at three EFS sites from about -30C to 110C; a technician intervened before product loss was reported. A ransom-isac.org analysis of a Copeland XWEB Pro 1.9.0 incident on 2026-11-02 (03:10-03:44 UTC) shows two Administrator sessions, from 198.251.85.67 and 85.137.52.63. The first session ran parameter reconnaissance across 31 refrigeration devices, then performed 588 parameter writes across 26 devices. The second session performed 155 parameter writes across 5 cold rooms and issued commands. In total there were 743 parameter changes, setpoints of 110C and 150C, alarm muting, keypad locking and defrost activation, at a pace consistent with a script or bulk-programming function. The author states default-credential use required no vulnerability, and that the device ran a version affected by CVE-2026-21718 and CVE-2026-24663 (fixed in Copeland 1.13), but they have no evidence tying the incident to the France attacks. The campaign is unattributed by the authorities. On 2026-11-04 Z-Pentest Alliance and NoName057(16) posted messages that were read as semi-claims; a substack analysis rates these as probably genuine channel material but without verifiable non-public detail, and rates the leading actor hypothesis at moderate confidence with copycat activity as the alternative. ANSSI reportedly assessed that the French wave abused weak, default or shared contractor credentials on internet-exposed administration interfaces. Related vulnerabilities in the product families include Danfoss AK-SM 8xxA CVE-2025-41450/41451/41452 (fixed in 4.3.1 per secondary reporting) and 23 Copeland XWEB/XWEB Pro flaws in CISA ICSA-26-057-10, but production exploitation of specific CVEs in the October and November waves is not confirmed in the sources. Exposure telemetry: Coalition counted 1,506 exposed Danfoss StoreView panels (54% in France) between Sept 7 and Oct 6; Forescout counted 12,976 exposed refrigeration management services in 99 countries; Censys reported a 53% reduction in exposed controllers after the incidents. ## MITRE ATT&CK - T1596.005 Search Open Technical Databases: Scan Databases - T1190 Exploit Public-Facing Application - T1078.001 Valid Accounts: Default Accounts - T1199 Trusted Relationship - T1133 External Remote Services - T0859 Valid Accounts - T1565.001 Stored Data Manipulation - T0883 Internet Accessible Device - T0836 Modify Parameter - T0855 Unauthorized Command Message - T0831 Manipulation of Control - T0832 Manipulation of View - T0879 Damage to Property - T0826 Loss of Availability - T1595 Active Scanning - T0828 Loss of Productivity and Revenue ## Free detection (Splunk SPL, Microsoft KQL, Sigma) **Refrigeration Controller (Danfoss StoreView / Copeland XWEB) Default-Account or Known-IOC Login — TL-2026-5429** (`TL-2026-5429-SPL-001`) Detects successful logins to Danfoss StoreView AK-SM/AK-SC, Copeland/Dixell XWEB/XWEB Pro or CAREL pCOWeb management interfaces from the attacker IPs named in the Copeland XWEB Pro incident (198.251.85.67, 85.137.52.63) and the decoy-observed 188.208.141.210, or logins by a factory-default or generic admin account (Supervisor, Admin, Administrator, Dixell) from non-RFC1918 space between 00:00 and 05:00 UTC. ANSSI assessed default or shared contractor credentials on internet-exposed interfaces as the primary access path in the French supermarket wave, so this behaviour-first rule fires without relying on a CVE. Requires controller syslog/audit forwarded to Splunk. - **Languages:** Splunk SPL, Microsoft KQL, Sigma - **ATT&CK:** T1078.001, T1133, T1078 - **Data sources:** controller syslog (index=ot, sourcetype=syslog), firewall/VPN access logs - **Severity:** high - **Confidence:** high ### Splunk SPL ```spl index=ot sourcetype=syslog earliest=-24h ("XWEB" OR "StoreView" OR "AK-SM" OR "pCOWeb") ("login" OR "logged in" OR "authentication") ("success" OR "accepted") | rex field=_raw "(?i)(?:user(?:name)?|account)[=:]\s*\W?(?[A-Za-z0-9_.-]+)" | rex field=_raw "(?i)(?:src|from|client|remote_addr)[=:\s]+(?\d{1,3}(?:\.\d{1,3}){3})" | eval hr=tonumber(strftime(_time,"%H")) | eval ioc_ip=if(ctl_src IN ("198.251.85.67","85.137.52.63","188.208.141.210"),1,0) | eval default_acct=if(match(ctl_user,"(?i)^(supervisor|admin|administrator|dixell)$"),1,0) | eval external=if(cidrmatch("10.0.0.0/8",ctl_src) OR cidrmatch("172.16.0.0/12",ctl_src) OR cidrmatch("192.168.0.0/16",ctl_src),0,1) | where ioc_ip=1 OR (default_acct=1 AND external=1 AND hr<5) | stats count min(_time) AS first_seen max(_time) AS last_seen values(ctl_user) AS users BY host ctl_src ioc_ip | convert ctime(first_seen) ctime(last_seen) | eval threat_id="TL-2026-5429" ``` ### Microsoft KQL ```kql Syslog | where TimeGenerated > ago(24h) | where SyslogMessage has_any ("XWEB", "StoreView", "AK-SM", "pCOWeb") | where SyslogMessage has_any ("login", "logged in", "authentication") and SyslogMessage has_any ("success", "accepted") | extend CtlUser = extract(@"(?i)(?:user(?:name)?|account)[=:]\s*\W?([A-Za-z0-9_.-]+)", 1, SyslogMessage), SrcIp = extract(@"(?i)(?:src|from|client|remote_addr)[=:\s]+(\d{1,3}(?:\.\d{1,3}){3})", 1, SyslogMessage) | where SrcIp in ("198.251.85.67", "85.137.52.63", "188.208.141.210") or (CtlUser matches regex @"(?i)^(supervisor|admin|administrator|dixell)$" and hourofday(TimeGenerated) < 5 and not(ipv4_is_private(SrcIp))) | project TimeGenerated, Computer, HostIP, CtlUser, SrcIp, SyslogMessage ``` ### Sigma ```yaml title: Refrigeration Controller Login With Factory-Default Account id: 7c1d2e54-3a9b-4f6e-8d21-5b0a9c4e1f37 status: experimental description: Detects successful logins to Danfoss StoreView, Copeland/Dixell XWEB or CAREL pCOWeb interfaces using the factory-default Supervisor or Administrator accounts. Default or shared credentials were the assessed primary access path in the 2026 European refrigeration sabotage campaign (TL-2026-5429). references: - https://www.cisa.gov/resources-tools/resources/us-government-partners-urge-hardening-industrial-refrigeration-and-cold-chain-monitoring-systems - https://ransom-isac.org/blog/the-copeland-incident/ author: Threadlinqs Team date: 2026-11-06 tags: - attack.initial-access - attack.persistence - attack.t1078.001 - attack.t1133 - cve.2026-21718 logsource: product: linux service: syslog detection: keywords_controller: - 'XWEB' - 'StoreView' - 'AK-SM' - 'pCOWeb' keywords_login: - 'login success' - 'logged in' - 'authentication success' - 'accepted' keywords_default_user: - 'user=Supervisor' - 'username=Supervisor' - 'user: Supervisor' - 'user=Administrator' - 'username=Administrator' - 'user=Dixell' condition: keywords_controller and keywords_login and keywords_default_user falsepositives: - Authorised engineers who still use the default account from the corporate network - Commissioning of a newly installed controller level: high ``` **Known false positives:** - Authorised maintenance engineer logging in with the default Supervisor/Administrator account during an out-of-hours call-out - Initial commissioning of a new XWEB or StoreView controller before credentials are rotated **Tuning notes:** Adjust index/sourcetype and the rex field names to match how your controller or syslog relay formats login events. The hour<5 test is UTC; shift it to local store time. Allowlist contractor egress IPs and approved maintenance windows. Ideally rotate default credentials so any default-account success is a true positive. ### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds - Defender for Endpoint: Connections to Refrigeration Controller Admin Interfaces From Known TL-2026-5429 IPs (locked: unlock with TL Creds) - Controller Alarm Muting, Keypad Lock and Defrost Activation Commands — Refrigeration Sabotage (locked: unlock with TL Creds) - Contractor or External Account Writing Controller Parameters Across Multiple Sites (locked: unlock with TL Creds) - Refrigeration Controller Default-Credential Login Attempts and Success — Sigma Primary (locked: unlock with TL Creds) - Refrigeration Controller Defrost Window Extended or Defrost Forced Overnight — Sigma Primary (locked: unlock with TL Creds) - Controller Admin Interface Reached From Hosting-Provider Infrastructure Linked To TL-2026-5429 — Sigma Primary (locked: unlock with TL Creds) - Bulk Refrigeration Controller Parameter Writes and Implausible Setpoints — TL-2026-5429 (locked: unlock with TL Creds) - External Source Reaching Multiple OT Controllers or Known TL-2026-5429 Attacker IP — Firewall (locked: unlock with TL Creds) Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup ## Sample indicators (3 of 26) Defanged, TLP:CLEAR. - IP address: `198.251.85[.]67` - IP address: `85.137.52[.]63` - IP address: `188.208.141[.]210` Full set of 26 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds ## Sources - [US Government Partners Urge Hardening of Industrial Refrigeration and Cold Chain Monitoring Systems (CISA)](https://www.cisa.gov/resources-tools/resources/us-government-partners-urge-hardening-industrial-refrigeration-and-cold-chain-monitoring-systems) - [CISA, FBI Urge Action to Protect Industrial Refrigeration Networks (Infosecurity Magazine)](https://www.infosecurity-magazine.com/news/cisa-protect-refrigeration-networks/) - [Researchers warned attackers could 'defrost the food' months before French supermarkets got hit (The Register)](https://www.theregister.com/security/2026/10/15/researchers-warned-attackers-could-defrost-the-food-months-before-french-supermarkets-got-hit/5303425) - [The Copeland Incident (ransom-isac.org)](https://ransom-isac.org/blog/the-copeland-incident/) - [The 2026 European Refrigeration Sabotage Campaign (cyberwarrior76 substack)](https://cyberwarrior76.substack.com/p/the-2026-european-refrigeration-sabotage) - [NVD - CVE-2026-21718 (Copeland XWEB Pro authentication bypass)](https://nvd.nist.gov/vuln/detail/CVE-2026-21718) - [NVD - CVE-2026-24663 (Copeland XWEB Pro OS command injection)](https://nvd.nist.gov/vuln/detail/CVE-2026-24663) - [NVD - CVE-2025-41450 (Danfoss AK-SM 8xxA improper authentication)](https://nvd.nist.gov/vuln/detail/CVE-2025-41450) ## Full data The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp Canonical: https://intel.threadlinqs.com/threat/TL-2026-5429