Copeland XWEB PRO refrigeration controllers abused for spam botnet, proxy/tunnel traffic and default-credential setpoint tampering (CVE-2026-25085 suspected entry point)

Key facts

Detection coverage

As of 2026-11-09, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5564 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Copeland XWEB Parameter-Write Burst by Interactive Account

TL-2026-5564: detects bursts of controller parameter writes by a non-scheduler account, the signature of the 2026-11-02 default-credential incident (588 writes across 26 devices at about 98 per minute, then 155 more writes across five cold rooms). Alerts when an account exceeds 20 writes per minute or touches more than 3 devices in a 5-minute window (Ransom-ISAC guidance). Maps to ICS T0836 Modify Parameter and T0855 Unauthorized Command Message.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T0836, T0855, T1078.001
• Data sources: xweb_eventlog (index=ot, sourcetype=copeland:xweb:eventlog), XWEBEventLog_CL (Log Analytics custom table)
• Severity: high
• Confidence: medium

Splunk SPL

index=ot sourcetype="copeland:xweb:eventlog" action IN ("parameter_write", "param_write", "write_parameter") NOT user IN ("scheduler", "system") earliest=-1h
| bin _time span=5m
| stats count as writes dc(device) as devices_touched values(param) as params values(host) as xweb_host by _time user src_ip
| eval writes_per_min=round(writes/5, 1)
```thresholds follow Ransom-ISAC guidance of about 20 writes per minute or more than 3 devices in 5 minutes```
| where writes_per_min>20 OR devices_touched>3
| table _time xweb_host user src_ip writes writes_per_min devices_touched params

Microsoft KQL

XWEBEventLog_CL
| where TimeGenerated > ago(1h)
| where Action_s in~ ('parameter_write', 'param_write', 'write_parameter')
| where User_s !in~ ('scheduler', 'system')
| summarize Writes=count(), DevicesTouched=dcount(Device_s), Params=make_set(Param_s, 20) by bin(TimeGenerated, 5m), User_s, SrcIp_s, Computer
| extend WritesPerMin = round(todouble(Writes) / 5, 1)
| where WritesPerMin > 20 or DevicesTouched > 3

Sigma

title: Copeland XWEB Parameter Write
name: xweb_parameter_write
id: 1c7a9e20-4d58-4f3b-8e61-a2b5c9d07e33
status: experimental
description: Base rule matching individual parameter writes on a Copeland XWEB controller by non-scheduler accounts. Used by the burst correlation rule below.
author: Threadlinqs Team
date: 2026/11/09
logsource:
  product: copeland
  service: xweb_eventlog
detection:
  selection:
    action:
      - 'parameter_write'
      - 'param_write'
      - 'write_parameter'
  filter_scheduler:
    user:
      - 'scheduler'
      - 'system'
  condition: selection and not filter_scheduler
falsepositives:
  - Planned commissioning or maintenance
level: informational
---
title: Copeland XWEB Parameter Write Burst
id: 9e4b6d11-2f0a-47c8-b5d3-0f1e8a7c6b24
status: experimental
description: Detects 100 or more parameter writes in 5 minutes by one account and source on a Copeland XWEB controller, matching the 2026-11-02 default-credential incident (TL-2026-5564).
references:
  - https://ransom-isac.org/blog/the-copeland-incident/
author: Threadlinqs Team
date: 2026/11/09
tags:
  - attack.impact
  - attack.t1078.001
correlation:
  type: event_count
  rules:
    - xweb_parameter_write
  group-by:
    - user
    - src_ip
  timespan: 5m
  condition:
    gte: 100
falsepositives:
  - Bulk configuration restore or commissioning by a known engineer
level: high

Known false positives:

• Commissioning, bulk configuration restore or planned maintenance by a known engineer
• Supervisory software pushing template parameters to many controllers

Tuning notes: Thresholds (20 writes/min, more than 3 devices per 5 minutes) come from Ransom-ISAC guidance; raise them if routine commissioning triggers alerts. Exclude approved engineering accounts or maintenance windows with a lookup. The Sigma correlation uses 100 writes per 5 minutes, which is equivalent to 20 per minute.

• 🔒 Command-Injection Patterns in Web Requests to XWEB Management Interface · unlock with TL Creds
• 🔒 Out-of-Range Setpoint or Alarm-Threshold Writes on XWEB Controllers · unlock with TL Creds
• 🔒 XWEB Controller Acting as VPN Tunnel / Residential-Proxy Node · unlock with TL Creds
• 🔒 Internet-Originated Access to XWEB Management Interface (TCP 8015/443) · unlock with TL Creds
• 🔒 Non-Scheduler Alarm Mute, Keypad Lock or Defrost Command on XWEB · unlock with TL Creds
• 🔒 Contact with STRIKE-Reported XWEB Botnet Tunnel and Shared Endpoints and Community Siblings · unlock with TL Creds
• 🔒 Copeland XWEB Administrator Login from Non-Internal Source (Default Credentials / Auth Bypass) · unlock with TL Creds
• 🔒 Outbound SMTP Fan-Out from XWEB Refrigeration Controllers (Spam Botnet) · unlock with TL Creds

Indicators of compromise

As of 2026-11-09, Threadlinqs Intelligence tracks 18 indicators of compromise for TL-2026-5564.

Sample indicators (3 of 18)

• IP address: 198.251.85[.]67
• IP address: 85.137.52[.]63
• IP address: 197.188.223[.]161

Defanged, TLP:CLEAR. Full set of 18 indicators: unlock with TL Creds.

Technical analysis

CVE-2026-25085 (pre-auth login bypass) is the suspected but unconfirmed entry point for the botnet activity.

Copeland (formerly Dixell) XWEB PRO is a Linux-based supervisory controller installed above freezer and chiller racks in supermarkets and cold storage. It talks Modbus to field controllers and exposes a web interface on TCP 8015 and 443. In February 2026 CISA published ICSA-26-057-10 covering 23 CVEs in the XWEB 300D PRO, 500D PRO and 500B PRO (firmware 1.12.1 and earlier), reported by Claroty Team82 (Amir Zaltzman) and fixed in firmware 1.13. The set includes CVE-2026-25085 (CWE-394, CVSS 8.6), a Lua logic flaw in which user_authenticate returns an empty table for an unrecognized auth_mode that the router treats as truthy, so the request passes as authenticated; CVE-2026-21718 (CWE-327, CVSS 10.0), deterministic admin credentials derived from date, MAC address and hardcoded keys; CVE-2026-24663 (CWE-78, CVSS 9.0), unauthenticated OS command injection; and about 19 further authenticated command-injection flaws. Team82 demonstrated chaining an auth bypass with command injection to root, then using Modbus to an XR60CX field controller to display a normal temperature while disabling cooling fans.

SecurityScorecard STRIKE (blog published 2026-11-05, first identified 2026-11-02) analysed Driftnet scan data (2026-10-05 to 2026-11-04) and reported two clusters. First, a suspected SMTP spam botnet of nine IPs with outbound-only traffic to TCP 25/465/587, tiny (~250 byte) flows and no inbound mail; three were passively confirmed as XWEB devices (certificate CN XWEB PRO, page title XWEB EVO, certificate Dixell). 508 of 1,041 email targets were hit by two or more nodes and the top three nodes shared about 47% of targets, which STRIKE treats as the strongest coordination signal. Two weak shared endpoints (46.255.231.42:993 and 143.244.202.96:2525) are possible C2 but no controller was identified. Second, two XWEB panels were repurposed: 197.188.223.161 (Telecom Namibia) acted as an OpenVPN/IPsec tunnel gateway carrying about 71% of flows in the capture with about 1.24 million sessions to 160.19.119.226:443; and 168.195.122.22 (Air Link Communications, Trinidad and Tobago) connected to 10,643 distinct peers in 17 hours (WireGuard, STUN, MQTT), consistent with a residential-proxy exit. STRIKE rates overall confidence as low to medium, corrected several earlier over-stated hypotheses (a 185.162.154.0/24 'C2 block' was 128 victim devices; a nine-IP list was a false positive from xweb.ru/xweb.at mail hosts), and instructs defenders to treat listed IPs as victims or abused infrastructure, not adversary-owned assets. The CVE-2026-25085 entry point is the analysts' belief, not confirmed.

Independently, Ransom-ISAC (Massimo Giaimo, 2026-11-06) analysed an XWEB event log from 2 November 2026 for a controller on firmware 1.9.0 reachable from the internet. No vulnerability was used: the factory Administrator credentials had not been changed. A first Administrator session from 198.251.85.67 (~03:10) read 31 devices, then performed 588 parameter writes across 26 devices (~03:15-03:21, about 98 per minute) and sent an Alarm Mute; a second session from 85.137.52.63 (~03:36) made 155 further writes across five cold rooms with keypad locks, alarm mutes and defrost commands. Written parameters included SEt (setpoints of 110C and 150C), ALL/ALU alarm thresholds (150 or 255), defrost parameters idF/MdF/dFd/dtS/dtE and several controls set to 0. This activity is not linked by any source to the spam/proxy cluster, to the October 2026 French supermarket attacks, to the French blood service (EFS) freezer incident, or to claims by NoName057(16) and Z-Pentest, which are unconfirmed.

Defender guidance: remove direct internet exposure of XWEB/XWEB PRO management interfaces, change default Administrator credentials, upgrade to firmware 1.13 (SYSTEM > Updates | Network or the Copeland update page), place supervisory controllers in a dedicated OT zone with brokered MFA remote access, keep independent temperature monitoring, and hunt for XWEB hosts with outbound SMTP fan-out and no inbound mail, bursts of parameter writes, non-scheduler KeyboardLock/Alarm Mute/Defrost commands and out-of-range setpoints. Note: CVSS for CVE-2026-25085 is 8.6 (CISA ICS-CERT, High) and 9.8 per the NVD primary score. Vendor (Copeland/Dixell) statements on this specific abuse were not found in the sources.

MITRE ATT&CK techniques by tactic:

Initial Access

T1078.001 Valid Accounts: Default Accounts; T1190 Exploit Public-Facing Application

Command and Control

T1090 Proxy; T1572 Protocol Tunneling

Impact

T1496.002 Resource Hijacking: Bandwidth Hijacking

Resource Development

T1584.005 Compromise Infrastructure: Botnet

Remediation

Patches

• Upgrade XWEB 300D PRO, 500D PRO and 500B PRO to firmware 1.13 or later via the Copeland software update page or SYSTEM > Updates | Network (ICSA-26-057-10)

Immediate actions

• Change the default Administrator password and any other default credentials on all XWEB / XWEB PRO units
• Remove direct internet reachability: disable port forwarding and public management access (TCP 8015 and 443) and apply an upstream deny rule
• Inventory all XWEB/XWEB PRO models and firmware; prioritise devices at or below 1.12.1
• Block or alert on outbound SMTP (25/465/587) from OT/refrigeration controller segments
• If compromise is suspected: preserve the XWEB event log, isolate the management plane, restore known-good configuration, rotate credentials from a clean workstation and independently verify temperatures and product safety

Workarounds

• Back up configuration before updating and coordinate with food-safety staff; validate alarms, sensors, local controls, defrost and cooling after the update
• Treat IPs listed by SecurityScorecard as victims or abused infrastructure when taking action, not as adversary-owned assets

Longer-term hardening

• Place supervisory controllers in a dedicated OT zone behind firewalls, deny inbound internet by default
• Use brokered, monitored remote access (organization-managed VPN or secure gateway) with MFA, named accounts, restricted source networks and session logging
• Deploy independent temperature monitoring and alert paths, and test alarms regularly
• Maintain an asset register (model, firmware, owner, exposure, patch status) and subscribe to vendor and CISA advisories
• Keep offline, tested configuration backups and a written safe-recovery procedure

Affected and fixed versions

• Copeland (Dixell) — XWEB 300D PRO
  Vulnerable versions: <= 1.12.1
  Fixed in: 1.13
• Copeland (Dixell) — XWEB 500D PRO
  Vulnerable versions: <= 1.12.1
  Fixed in: 1.13
• Copeland (Dixell) — XWEB 500B PRO
  Vulnerable versions: <= 1.12.1
  Fixed in: 1.13

Timeline

• 2026-02-26 CISA publishes ICSA-26-057-10 covering 23 CVEs in Copeland XWEB 300D/500D/500B PRO (<= 1.12.1), reported by Claroty Team82; Copeland fix released in firmware 1.13
• 2026-02-27 CVE-2026-25085 (authentication bypass, CWE-394, CVSS 8.6 CISA / 9.8 NVD) published in NVD
• 2026-08-09 Claroty Team82 publishes 'Chilling Discoveries' detailing the Lua auth bypass and the bypass-to-root-RCE chain with Modbus temperature spoofing demo
• 2026-10-05 Start of the Driftnet scan-data window (to 2026-11-04) later used by SecurityScorecard STRIKE to identify XWEB botnet, tunnel and proxy nodes
• 2026-11-02 SecurityScorecard STRIKE first identifies nine IPs sending outbound-only spam, three confirmed as XWEB controllers
• 2026-11-02 Early hours: Administrator sessions from locked-ioc-7 (~03:10) and locked-ioc-11 (~03:36) using default credentials read 31 devices and made 743 parameter writes on a Copeland XWEB Pro (firmware 1.9.0), including 110C/150C setpoints, alarm mutes, keypad locks and defrost commands
• 2026-11-04 NoName057(16) and Z-Pentest claim the European supermarket refrigeration attacks (unconfirmed, not tied to this activity); French blood service EFS confirms temperature spikes at three sites
• 2026-11-05 SecurityScorecard publishes 'A Dish Served Lukewarm: The Refrigerator Botnet' with low-to-medium confidence assessment and IOC appendix
• 2026-11-06 Ransom-ISAC publishes 'The Copeland Incident' documenting the default-credential session activity and detection recommendations
• 2026-11-09 Help Net Security reports the refrigeration-controller spam botnet and proxy abuse

Sources cited

• CISA ICS Advisory ICSA-26-057-10: Copeland XWEB and XWEB Pro CISA · Government advisory · 2026-02-26
• NVD: CVE-2026-25085 NVD (NIST) · Advisory · 2026-02-27
• A Dish Served Lukewarm: The Refrigerator Botnet (SecurityScorecard STRIKE) securityscorecard.com · Research · 2026-11-05
• The Copeland Incident (Ransom-ISAC) ransom-isac.org · Research · 2026-11-06
• Chilling Discoveries: Unpacking Vulnerabilities in Copeland XWEB Pro Controllers (Claroty Team82) claroty.com · Research · 2026-08-09
• Copeland Dixell XWEB system software update page webapps.copeland.com · Vendor report · 2026-02-26
• CISA CSAF file icsa-26-057-10 GitHub · Code repository · 2026-02-26
• Hackers abuse refrigeration controllers to send spam and route proxy traffic (Help Net Security) Help Net Security · News · 2026-11-09

More in ics scada

• Iranian-Affiliated Actors Exploit Internet-Exposed PLCs (Rockwell, Schneider, Siemens) in U.S. Critical Infrastructure (CISA AA26-097A)
• Malicious Cyber Activity Targeting Industrial Refrigeration and Cold Chain Monitoring Systems (Danfoss StoreView, Copeland/Dixell XWEB, Coolworld)
• Second Wave of Attacks on European Supermarket Refrigeration Controllers (Danfoss AK-SM/AK-SC, Copeland/Dixell XWEB) Forces Defrost Mode
• CVE-2026-21656 - Johnson Controls Frick Controls Quantum HD Pre-Authentication Code Injection (CWE-94)
• Threat actors targeting internet-exposed PLCs in US water/wastewater sector causing lockouts, disconnections and boil water notices (CISA alert 2026-07-30; Iranian-affiliated PLC campaign AA26-097A)

Other reports on CVE-2026-25085

• Refrigeration controller attack in France: internet-exposed Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB controllers forced into defrost cycles at hundreds of grocery stores (CVE-2025-41450)
• CVE-2026-25196: Copeland XWEB Pro OS Command Injection via Wi-Fi SSID/Password Fields (Authenticated RCE)
• CVE-2026-3037: OS Command Injection in Copeland XWEB Pro (MBird SMS service) enabling authenticated RCE

Other reports on CVE-2026-21718

• CVE-2026-22877: Copeland XWEB / XWEB Pro Unauthenticated Arbitrary File Read (Path Traversal)