Threat video1:00
Copeland/Dixell XWEB Setpoint Attacks: Detection & IOCs
Attackers alter setpoints on Copeland/Dixell XWEB and Danfoss controllers: 9 detection rules, 14 IOCs and a free Splunk SPL rule.
Chapters
- 0:00The hookAbout 700 French supermarkets were hit.
- 0:04The storySetpoints were pushed to 50C.
- 0:10Attack pathReported: exposed controllers, default logins.
- 0:28AttributionAttributed to Shahid Kaveh.
- 0:32Indicators of compromise5 indicators to hunt: 3 IPs and 2 hostings.
- 0:37MITRE ATT&CK techniques16 ATT&CK techniques, from reconnaissance to impair process control.
- 0:42Remediation5 steps now: Remove direct public internet exposure of refrigeration controllers and supervisory.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00About 700 French supermarkets were hit.
0:05Setpoints were pushed to 50C.
0:07Wave two, reportedly across Europe.
0:10Reported: exposed controllers, default logins.
0:14Two Administrator sessions wrote setpoints.
0:16Spoilage and reported fires followed.
0:19Contractor access changed three blood-service freezers.
0:23A joint advisory warns: sector targeted.
0:28Attributed to Shahid Kaveh. Confidence: high.
0:325 indicators to hunt: 3 IPs and 2 hostings.
0:3816 ATT&CK techniques, from reconnaissance to impair process control.
0:435 steps now: Remove direct public internet exposure of refrigeration controllers and supervisory.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.