# Copeland XWEB PRO refrigeration controllers abused for spam botnet, proxy/tunnel traffic and default-credential setpoint tampering (CVE-2026-25085 suspected entry point)

> SecurityScorecard STRIKE identified (Nov 2, 2026) nine IPs sending outbound-only spam, three confirmed as Dixell/Copeland XWEB controllers, plus two XWEB panels repurposed as a VPN tunnel gateway and a residential-proxy-style exit. Separately, Ransom-ISAC documented two Administrator sessions using factory default credentials that read 31 devices and made 743 parameter writes (110C/150C setpoints, muted alarms, locked keypads, defrost commands). CVE-2026-25085 (pre-auth login bypass) is the suspected but unconfirmed entry point for the botnet activity.

- **Published:** 2026-11-09T15:18:47Z
- **Last reviewed:** 2026-11-09T15:18:47Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5564
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5564.png
- **ID:** TL-2026-5564
- **Severity:** HIGH (CVSS 8.6)
- **Category:** ICS_SCADA
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 18 (3 shown free below)
- **CVEs:** CVE-2026-25085, CVE-2026-21718, CVE-2026-24663

## Description

Copeland (formerly Dixell) XWEB PRO is a Linux-based supervisory controller installed above freezer and chiller racks in supermarkets and cold storage. It talks Modbus to field controllers and exposes a web interface on TCP 8015 and 443. In February 2026 CISA published ICSA-26-057-10 covering 23 CVEs in the XWEB 300D PRO, 500D PRO and 500B PRO (firmware 1.12.1 and earlier), reported by Claroty Team82 (Amir Zaltzman) and fixed in firmware 1.13. The set includes CVE-2026-25085 (CWE-394, CVSS 8.6), a Lua logic flaw in which user_authenticate returns an empty table for an unrecognized auth_mode that the router treats as truthy, so the request passes as authenticated; CVE-2026-21718 (CWE-327, CVSS 10.0), deterministic admin credentials derived from date, MAC address and hardcoded keys; CVE-2026-24663 (CWE-78, CVSS 9.0), unauthenticated OS command injection; and about 19 further authenticated command-injection flaws. Team82 demonstrated chaining an auth bypass with command injection to root, then using Modbus to an XR60CX field controller to display a normal temperature while disabling cooling fans.

SecurityScorecard STRIKE (blog published 2026-11-05, first identified 2026-11-02) analysed Driftnet scan data (2026-10-05 to 2026-11-04) and reported two clusters. First, a suspected SMTP spam botnet of nine IPs with outbound-only traffic to TCP 25/465/587, tiny (~250 byte) flows and no inbound mail; three were passively confirmed as XWEB devices (certificate CN XWEB PRO, page title XWEB EVO, certificate Dixell). 508 of 1,041 email targets were hit by two or more nodes and the top three nodes shared about 47% of targets, which STRIKE treats as the strongest coordination signal. Two weak shared endpoints (46.255.231.42:993 and 143.244.202.96:2525) are possible C2 but no controller was identified. Second, two XWEB panels were repurposed: 197.188.223.161 (Telecom Namibia) acted as an OpenVPN/IPsec tunnel gateway carrying about 71% of flows in the capture with about 1.24 million sessions to 160.19.119.226:443; and 168.195.122.22 (Air Link Communications, Trinidad and Tobago) connected to 10,643 distinct peers in 17 hours (WireGuard, STUN, MQTT), consistent with a residential-proxy exit. STRIKE rates overall confidence as low to medium, corrected several earlier over-stated hypotheses (a 185.162.154.0/24 'C2 block' was 128 victim devices; a nine-IP list was a false positive from xweb.ru/xweb.at mail hosts), and instructs defenders to treat listed IPs as victims or abused infrastructure, not adversary-owned assets. The CVE-2026-25085 entry point is the analysts' belief, not confirmed.

Independently, Ransom-ISAC (Massimo Giaimo, 2026-11-06) analysed an XWEB event log from 2 November 2026 for a controller on firmware 1.9.0 reachable from the internet. No vulnerability was used: the factory Administrator credentials had not been changed. A first Administrator session from 198.251.85.67 (~03:10) read 31 devices, then performed 588 parameter writes across 26 devices (~03:15-03:21, about 98 per minute) and sent an Alarm Mute; a second session from 85.137.52.63 (~03:36) made 155 further writes across five cold rooms with keypad locks, alarm mutes and defrost commands. Written parameters included SEt (setpoints of 110C and 150C), ALL/ALU alarm thresholds (150 or 255), defrost parameters idF/MdF/dFd/dtS/dtE and several controls set to 0. This activity is not linked by any source to the spam/proxy cluster, to the October 2026 French supermarket attacks, to the French blood service (EFS) freezer incident, or to claims by NoName057(16) and Z-Pentest, which are unconfirmed.

Defender guidance: remove direct internet exposure of XWEB/XWEB PRO management interfaces, change default Administrator credentials, upgrade to firmware 1.13 (SYSTEM > Updates | Network or the Copeland update page), place supervisory controllers in a dedicated OT zone with brokered MFA remote access, keep independent temperature monitoring, and hunt for XWEB hosts with outbound SMTP fan-out and no inbound mail, bursts of parameter writes, non-scheduler KeyboardLock/Alarm Mute/Defrost commands and out-of-range setpoints. Note: CVSS for CVE-2026-25085 is 8.6 (CISA ICS-CERT, High) and 9.8 per the NVD primary score. Vendor (Copeland/Dixell) statements on this specific abuse were not found in the sources.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078.001 Valid Accounts: Default Accounts
- T1584.005 Compromise Infrastructure: Botnet
- T1090 Proxy
- T1572 Protocol Tunneling
- T1496.002 Resource Hijacking: Bandwidth Hijacking

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Copeland XWEB Parameter-Write Burst by Interactive Account** (`TL-2026-5564-SPL-002`)

TL-2026-5564: detects bursts of controller parameter writes by a non-scheduler account, the signature of the 2026-11-02 default-credential incident (588 writes across 26 devices at about 98 per minute, then 155 more writes across five cold rooms). Alerts when an account exceeds 20 writes per minute or touches more than 3 devices in a 5-minute window (Ransom-ISAC guidance). Maps to ICS T0836 Modify Parameter and T0855 Unauthorized Command Message.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T0836, T0855, T1078.001
- **Data sources:** xweb_eventlog (index=ot, sourcetype=copeland:xweb:eventlog), XWEBEventLog_CL (Log Analytics custom table)
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

````spl
index=ot sourcetype="copeland:xweb:eventlog" action IN ("parameter_write", "param_write", "write_parameter") NOT user IN ("scheduler", "system") earliest=-1h
| bin _time span=5m
| stats count as writes dc(device) as devices_touched values(param) as params values(host) as xweb_host by _time user src_ip
| eval writes_per_min=round(writes/5, 1)
```thresholds follow Ransom-ISAC guidance of about 20 writes per minute or more than 3 devices in 5 minutes```
| where writes_per_min>20 OR devices_touched>3
| table _time xweb_host user src_ip writes writes_per_min devices_touched params
````

### Microsoft KQL

```kql
XWEBEventLog_CL
| where TimeGenerated > ago(1h)
| where Action_s in~ ('parameter_write', 'param_write', 'write_parameter')
| where User_s !in~ ('scheduler', 'system')
| summarize Writes=count(), DevicesTouched=dcount(Device_s), Params=make_set(Param_s, 20) by bin(TimeGenerated, 5m), User_s, SrcIp_s, Computer
| extend WritesPerMin = round(todouble(Writes) / 5, 1)
| where WritesPerMin > 20 or DevicesTouched > 3
```

### Sigma

```yaml
title: Copeland XWEB Parameter Write
name: xweb_parameter_write
id: 1c7a9e20-4d58-4f3b-8e61-a2b5c9d07e33
status: experimental
description: Base rule matching individual parameter writes on a Copeland XWEB controller by non-scheduler accounts. Used by the burst correlation rule below.
author: Threadlinqs Team
date: 2026/11/09
logsource:
  product: copeland
  service: xweb_eventlog
detection:
  selection:
    action:
      - 'parameter_write'
      - 'param_write'
      - 'write_parameter'
  filter_scheduler:
    user:
      - 'scheduler'
      - 'system'
  condition: selection and not filter_scheduler
falsepositives:
  - Planned commissioning or maintenance
level: informational
---
title: Copeland XWEB Parameter Write Burst
id: 9e4b6d11-2f0a-47c8-b5d3-0f1e8a7c6b24
status: experimental
description: Detects 100 or more parameter writes in 5 minutes by one account and source on a Copeland XWEB controller, matching the 2026-11-02 default-credential incident (TL-2026-5564).
references:
  - https://ransom-isac.org/blog/the-copeland-incident/
author: Threadlinqs Team
date: 2026/11/09
tags:
  - attack.impact
  - attack.t1078.001
correlation:
  type: event_count
  rules:
    - xweb_parameter_write
  group-by:
    - user
    - src_ip
  timespan: 5m
  condition:
    gte: 100
falsepositives:
  - Bulk configuration restore or commissioning by a known engineer
level: high

```

**Known false positives:**

- Commissioning, bulk configuration restore or planned maintenance by a known engineer
- Supervisory software pushing template parameters to many controllers

**Tuning notes:** Thresholds (20 writes/min, more than 3 devices per 5 minutes) come from Ransom-ISAC guidance; raise them if routine commissioning triggers alerts. Exclude approved engineering accounts or maintenance windows with a lookup. The Sigma correlation uses 100 writes per 5 minutes, which is equivalent to 20 per minute.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Command-Injection Patterns in Web Requests to XWEB Management Interface (locked: unlock with TL Creds)
- Out-of-Range Setpoint or Alarm-Threshold Writes on XWEB Controllers (locked: unlock with TL Creds)
- XWEB Controller Acting as VPN Tunnel / Residential-Proxy Node (locked: unlock with TL Creds)
- Internet-Originated Access to XWEB Management Interface (TCP 8015/443) (locked: unlock with TL Creds)
- Non-Scheduler Alarm Mute, Keypad Lock or Defrost Command on XWEB (locked: unlock with TL Creds)
- Contact with STRIKE-Reported XWEB Botnet Tunnel and Shared Endpoints and Community Siblings (locked: unlock with TL Creds)
- Copeland XWEB Administrator Login from Non-Internal Source (Default Credentials / Auth Bypass) (locked: unlock with TL Creds)
- Outbound SMTP Fan-Out from XWEB Refrigeration Controllers (Spam Botnet) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 18)

Defanged, TLP:CLEAR.

- IP address: `198.251.85[.]67`
- IP address: `85.137.52[.]63`
- IP address: `197.188.223[.]161`

Full set of 18 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Hackers abuse refrigeration controllers to send spam and route proxy traffic (Help Net Security)](https://www.helpnetsecurity.com/2026/11/09/copeland-xweb-refrigeration-controllers-spam-botnet/)
- [A Dish Served Lukewarm: The Refrigerator Botnet (SecurityScorecard STRIKE)](https://securityscorecard.com/blog/a-dish-served-lukewarm-the-refrigerator-botnet/)
- [The Copeland Incident (Ransom-ISAC)](https://ransom-isac.org/blog/the-copeland-incident/)
- [CISA ICS Advisory ICSA-26-057-10: Copeland XWEB and XWEB Pro](https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-10)
- [CISA CSAF file icsa-26-057-10](https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-10.json)
- [NVD: CVE-2026-25085](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-25085)
- [Chilling Discoveries: Unpacking Vulnerabilities in Copeland XWEB Pro Controllers (Claroty Team82)](https://claroty.com/team82/research/chilling-discoveries-unpacking-vulnerabilities-in-copeland-xweb-pro-controllers)
- [Copeland Dixell XWEB system software update page](https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5564