{
	"id": "899fe198-3fce-437e-935f-2baa1bd1e00f",
	"created_at": "2026-11-14T02:11:37.383118Z",
	"updated_at": "2026-11-14T02:18:53.435821Z",
	"deleted_at": null,
	"sha1_hash": "24989eb016bed25bba4e464befde1d0688afaedd",
	"title": "European Refrigeration Systems Cyber Sabotage. An Intelligence Assessment Of The October–November 2026 Refrigeration Attacks.",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 6523138,
	"plain_text": "https://dti.domaintools.com/research/european-refrigeration-systems-cyber-sabotage\n\nEuropean Refrigeration Systems Cyber Sabotage. An Intelligence\n\nAssessment Of The October–November 2026 Refrigeration\n\nAttacks.\n\nBy DomainTools\n\nPublished: 2026-11-13 · Archived: 2026-11-14 02:00:22 UTC\n\nExecutive Summary\n\nA series of cyberattacks against commercial refrigeration infrastructure has exposed a significant weakness in the\n\noperational technologies and network implementations supporting Europe's food supply and other temperature-\n\nsensitive industrial systems. Beginning with hundreds of affected supermarkets in France during October 2026,\n\nthe incidents expanded across numerous European countries in early November, damaging food inventories,\n\ninterrupting business operations, and prompting a coordinated response from European cybersecurity authorities.\n\nThe attacks involve unauthorized manipulation of the control and management systems responsible for\n\nrefrigeration temperatures. Specifically, the attackers reportedly accessed refrigeration management interfaces and\n\nchanged the operating parameters controlling defrost cycles and temperature settings causing losses of product and\n\nfinancial losses.\n\nThe campaign's initial wave occurred October 11th–12th in France. A second wave on November 1st–2nd affected\n\nretailers across Belgium, Luxembourg, Sweden, the Netherlands, Ireland, Estonia, and Portugal. Subsequent\n\nreporting has added Italy, Finland, Germany, and Romania, with attempted attacks against British meat-processing\n\nfacilities as well.\n\nFrench authorities also confirmed an unauthorized manipulation of cold-storage equipment associated with three\n\nfacilities operated by the national blood service. Independent monitoring prevented the destruction of stored\n\nmedical products, but the incident expanded concerns beyond ordinary commercial refrigeration attacks to other\n\nkinds of infrastructure as well.\n\nOn November 4, the European Commission, ENISA, Europol's European Cybercrime Centre, EU-CyCLONe, and\n\nthe EU CSIRT Network issued a joint statement addressing the incidents. The statement recognized the scale and\n\ncross-border nature of the activity and called for immediate protective measures. The official European response\n\nestablishes the incidents as a significant cybersecurity concern affecting multiple member states.\n\nOn November 9, the French government formally attributed the attack on French supermarkets to  Shahid Kaveh,\n\nan offensive cyber unit operating within the Electronic and Cyber Centre of Iran's Islamic Revolutionary Guard\n\nCorps (IRGC). However, two Russian-aligned hacktivist organizations, NoName057(16) and Z-Pentest Alliance,\n\nreportedly published a video on November 4 claiming responsibility for the supermarket attacks. The groups\n\nidentified Danfoss and Dixell equipment as the attack vector and asserted that they manipulated existing controller\n\nfunctions without malware.\n\nPage 1 of 15\n\nhttps://dti.domaintools.com/research/european-refrigeration-systems-cyber-sabotage\n\nTheir claims are consistent with the observed operating methods and their histories of attacking exposed industrial\n\ncontrol systems. However, the details disclosed in the video were already available through public reporting, and\n\nno independent forensic evidence has authenticated their responsibility. Romania's national cybersecurity director\n\nsubsequently offered a competing assessment, describing the incidents as technically unsophisticated and stating\n\nthat it did not suspect a state actor. The current intelligence picture therefore supports a distinction between\n\nstrategic significance and operational attribution. The refrigeration attacks represent deliberate interference with\n\ncivilian industrial processes, but their relationship to Russian state-directed hybrid warfare remains a plausible but\n\nunproven hypothesis.\n\nOn a technical level however, the assessment is the following; the affected systems were online, available to the\n\ninternet, and in default states of installation. Default passwords and configurations of these systems allowed the\n\nadversaries to control and manipulate management of the refrigeration systems to cause damage to the products\n\nbeing refrigerated.\n\nAs such, these attacks are considered a “Trivial” attack methodology and could be undertaken by any individual or\n\ngroup of individuals who discovered them and decided to interfere. Given that the various claims of success by\n\nRussian aligned actors and France’s formal attribution to the Iranian state-backed Shahid Kaveh both lack\n\nindependent verification of evidence, it is hard to determine the who and the why behind them. The how, however,\n\nis clear, default installations and lack of security management are the direct culprit.\n\nCampaign Development and Operational Chronology\n\nThe cyberattacks against Europe's commercial refrigeration infrastructure began during the night of October 11–\n\n12th, 2026, when approximately 700 supermarkets across France experienced unauthorized manipulation of their\n\nrefrigeration systems.\n\nAt an Intermarché location in Gradignan, a defrost cycle was reportedly extended to eight hours, driving\n\ntemperatures to approximately 50°C. Three weeks later during the night of November 1st–2nd, another wave of\n\nattacks spread across Europe affecting supermarkets and food retailers in;\n\nBelgium\n\nLuxembourg\n\nSweden\n\nIreland\n\nThe Netherlands\n\nEstonia\n\nPage 2 of 15\n\nhttps://dti.domaintools.com/research/european-refrigeration-systems-cyber-sabotage\n\nPortugal\n\nBy November 3 additional incidents had been disclosed in Romania, Germany, Finland, and Italy, while British\n\nauthorities confirmed attempted intrusions against meat-processing businesses, showing the focus thus far, as\n\nsystems within the EU and UK.\n\nTechnical Mechanisms of Attacks\n\nCommercial refrigeration controllers, like many other OT (Operational Technology) systems, commonly provide\n\ncentralized interfaces for operating and maintaining equipment distributed throughout an organization. These\n\nrefrigeration interfaces allow technicians to monitor temperatures, adjust defrost schedules, and configure alarms\n\nto perform maintenance remotely.\n\nSystems such as the Danfoss AK-SM family and Copeland/Dixell XWEB platforms are deployed in environments\n\nwhere availability and reliable operation are essential. Their connectivity provides operational efficiency but it\n\nalso creates potential security exposure, especially when they are not configured securely. If an attacker gains\n\nadministrative access, they can potentially change operating parameters without needing to modify the underlying\n\nfirmware or install additional software.\n\nThe observed attack pattern can be summarized as:\n\nPage 3 of 15\n\nhttps://dti.domaintools.com/research/european-refrigeration-systems-cyber-sabotage\n\nThe most important distinction is that the malicious action may consist entirely of legitimate controller commands\n\nand access. The controller performs the requested action, but the request originates from an unauthorized operator.\n\nThis creates a detection problem because normal maintenance activities and malicious process manipulation may\n\ngenerate similar administrative events.\n\nDetecting these kinds of attacks depends on authorization contexts, account identities, configuration history, and\n\nthe timing of changes. The evidence currently suggests that in this case, the attacks are against the management\n\nlayer rather than deployment of any bespoke industrial malware. However, the exact initial-access mechanism\n\nremains unresolved for the November wave. No substantive evidence has been presented by the companies nor the\n\ninvestigating bodies involved as yet.\n\nThere are, however, some vulnerabilities for these systems that are already known from CVE’s that have been\n\npublished. Claroty Team82 documented three significant vulnerabilities affecting Danfoss AK-SM 800A\n\nrefrigeration management systems.\n\nconfiguration.\n\nCVE identifier\n\nCVE-2025-41450\n\nCVE-2025-41451\n\nCVE-2025-41452\n\nCVE\n\nidentifier\n\nCVE-2023-\n\n25913\n\nCVE-2023-\n\n25914\n\nCVE-2023-\n\n25915\n\nThese included authentication bypass, authenticated command injection, and manipulation of web-server\n\nVulnerability\n\nAuthentication bypass\n\nAuthenticated OS command injection\n\nWeb-server configuration manipulation\n\nEarlier vulnerabilities in the same product family include:\n\nVulnerability\n\nAuthentication bypass and sensitive\n\ninformation disclosure\n\nPath traversal allowing unauthorized access\n\nto system files\n\nRemote command execution through\n\nimproper input validation\n\nSeverity\n\n(CVSS)\n\n7.5 High\n\n7.5 High\n\n9.8 Critical\n\nRecommended remediation\n\nUpgrade to firmware 4.2 or later\n\nUpgrade to firmware 4.3.1 or later\n\nUpgrade to firmware 4.3.1 or later\n\nRecommended\n\nremediation\n\nUpgrade to firmware 3.3\n\nor later\n\nUpgrade to firmware 3.3\n\nor later\n\nUpgrade to firmware 3.3\n\nor later\n\nThe older Danfoss AK-SM 800 and AK-SC 355 models are end-of-life products and require particular attention\n\nbecause normal security patching may no longer be available. These vulnerabilities are one of the security risks\n\nPage 4 of 15\n\nhttps://dti.domaintools.com/research/european-refrigeration-systems-cyber-sabotage\n\nassociated with exposed management interfaces on top of potential default configuration issues that can lead to\n\ncompromise.\n\nInternet Exposed Refrigeration Controllers\n\nIndependent research by Flare and Censys identified a substantial population of publicly accessible refrigeration\n\nmanagement systems. Flare's baseline research identified at least 2,667 distinct public IP addresses associated with\n\nexposed refrigeration management interfaces. In a sample of 547 confirmed addresses, 356 exposed additional\n\nservices as well, including remote desktop systems, camera and video services, and VPN infrastructure.\n\nRefrigeration controllers are frequently part of more complex remote access environments, hence the co-location\n\nof services. In these instances, a single public IP may represent access to multiple internal services operating\n\nbehind a router, firewall, or network address translation gateway. This creates multiple possibilities for\n\nunauthorized access and potentially larger attack surfaces for more companies' devices online.\n\nThus, an attacker may connect directly to the controller's management interface, compromise a separate\n\nadministrative service or obtain access through a contractor-operated VPN accessing multiple systems. However,\n\nthe presence of a VPN on an exposed address does not establish that it was compromised or used during an attack.\n\nIndependently, the security company Censys scanned the internet and found a large number of the Danfoss\n\ninterfaces on the internet available to access.\n\nAttack activity by country\n\nA significant percentage of the exposed systems in some countries appeared to be running the supported firmware\n\nPage 5 of 15\n\nhttps://dti.domaintools.com/research/european-refrigeration-systems-cyber-sabotage\n\nwith open access to the internet, reinforcing the importance of access controls and basic security management.\n\nPatching known vulnerabilities does not protect a controller if an unauthorized person can authenticate using a\n\nweak or reused password.\n\nNetwork and Forensic Indicators Thus Far\n\nNo confirmed attacker-controlled IP addresses, domains, VPN exit nodes, or malware hashes have been publicly\n\nestablished for the campaign. One previously reported address, 188.208.141[.]210, was associated with\n\nauthentication attempts against a Danfoss honeypot during October. However, this is a reconnaissance lead and\n\nhas not been forensically connected to any confirmed European victim and therefore should not be classified as a\n\nverified campaign IOC.\n\nInvestigation of IP address space 188.208.141[.]210 identified reconnaissance and attempted authentication\n\nagainst a Danfoss AK-SM refrigeration controller honeypot during October 25–27, 2026. The address resides\n\nwithin the 188.208.141.0/24 netblock, announced by AS132335 LeapSwitch Networks Private Limited. This is an\n\nIndia-based hosting provider operating geographically distributed infrastructure.\n\nResearchers at Previdian observed the address initially accessing a simulated Danfoss AK-SM 800A management\n\ninterface in Finland on October 25th with an HTTP Referer suggesting possible discovery through a FOFA\n\n(internet asset search platform) report . The source returned on October 27 and conducted additional\n\nreconnaissance, requesting SVB5.ver and metadata.json to identify controller information before using Python-\n\nbased requests to attempt authentication through the /xml.cgi endpoint.\n\nThree login attempts using documented factory-default credentials were all unsuccessful. The activity\n\ndemonstrates deliberate controller fingerprinting followed by attempted unauthorized access rather than\n\nexploitation of the documented Danfoss authentication-bypass vulnerability, CVE-2025-41450.\n\nAlthough other addresses within the LeapSwitch netblock have appeared in unrelated abuse reporting, no evidence\n\nestablishes coordinated malicious activity across the netspace. The source address remains a credible\n\nreconnaissance indicator associated with Danfoss management infrastructure, but no forensic evidence currently\n\nlinks it to the European refrigeration sabotage campaign.\n\nNovember 4 claims by NoName057(16) and Z-Pentest Alliance\n\nPage 6 of 15\n\nhttps://dti.domaintools.com/research/european-refrigeration-systems-cyber-sabotage\n\n“Operation Chronicle: Danfoss” Операция «Хроника: Данфосс»\n\nRussian-aligned hacktivist organizations NoName057(16) and Z-Pentest Alliance made a claim that they had been\n\nthe actors behind the attacks. This emerged through public hacktivist communications by these groups on\n\nTelegram , and on November 4, Italian broadcaster Rai TG1 released a video claiming responsibility for the\n\nEuropean supermarket attacks by the groups.\n\nTelegram Channel (New) for NoName057\n\nThe groups described interference with Danfoss and Dixell management systems and asserted that the operation\n\ndid not require malware. They also threatened further attacks against water, energy, industrial, and food-storage\n\ninfrastructure. The claim is aligned with previous Z-Pentest posts  advertising intrusions involving exposed\n\nindustrial control systems.\n\nPage 7 of 15\n\nhttps://dti.domaintools.com/research/european-refrigeration-systems-cyber-sabotage\n\nМы на стороне народа Караем европейских политиков за их преступления\n\n(Machine Translation: We stand with the people: Punishing European politicians for their crimes, Wrecking\n\nRefrigerators titles)\n\nAdditionally, on their darknet site, NoName057(16) also made claims about hacking other infrastructure in the\n\nEU, including France during the recent protests that have been taking place in October and November. However,\n\nnone of these videos actually show hands on keyboard access or video proof that they had access to anything. The\n\ngroups' statements did not demonstrate possession of nonpublic forensic details concerning the European victims.\n\nManufacturer names, defrost manipulation, and publicly reported consequences were already widely available.\n\nAdditionally, both NoName057(16) and Z-Pentest have a history of claiming attacks on OT (Operational\n\nTechnology) systems in support of Russia.\n\nGiven the existing evidence,  these claims are best assessed as propaganda unless the groups share proof of their\n\nrole in the attacks.\n\nAn Alleged Danfoss Credential Database Leak\n\nPage 8 of 15\n\nhttps://dti.domaintools.com/research/european-refrigeration-systems-cyber-sabotage\n\nAssociated reporting by SVT described an alleged database containing more than 2,500 records involving Danfoss\n\nemployees or customers that NoName057(16) claimed to be in possession of on their telegram channel. The\n\nrecords reportedly included usernames and passwords. If authentic and operationally relevant, such a collection\n\ncould help explain access to multiple installations through common credentials or maintenance accounts.\n\nThe dataset has not been independently authenticated, though one source claims to have had access to the data; its\n\nage, provenance, validity, and relationship to the affected installations remain unknown. Seeing as there is also no\n\nverified evidence that the records were actually used to access refrigeration controllers, the database should\n\nremain a high-priority investigative lead rather than a confirmed compromise artifact.\n\nThreat Actor Assessment: NoName057(16), Z-Pentest \u0026 CARR\n\nPage 9 of 15\n\nhttps://dti.domaintools.com/research/european-refrigeration-systems-cyber-sabotage\n\nNoName057(16) Telegram Banner\n\nNoName057(16) emerged in 2022 as a pro-Russian hacktivist organization primarily associated with distributed\n\ndenial-of-service attacks against governments and other organizations in countries supporting Ukraine. Its\n\noperations have combined service disruption with public propaganda intended to promote the Kremlin’s\n\ngeopolitical narratives.\n\nZ-Pentest developed a more specialized focus on exposed industrial control systems. The group has claimed\n\naccess to remotely managed industrial equipment, including human-machine interfaces and systems used in\n\ncivilian infrastructure. Its historical activity makes it a technically plausible suspect in the refrigeration incidents.\n\nThese are not the only Russian aligned actors with a history of targeting civilian infrastructure and refrigeration\n\nsystems. The attribution of CyberArmyofRussia_Reborn, or CARR, provides a particularly important historical\n\ncomparison. U.S. authorities previously attributed a 2024 refrigeration-related attack against a Los Angeles meat-\n\nprocessing facility to CARR. That incident reportedly produced food spoilage and an ammonia leak.\n\nA December 2025 multinational advisory documented relationships among NoName057(16), Z-Pentest, and\n\nCARR. These relationships establish an overlapping operational environment associated with pro-Russian\n\ndisruptive activity. They do not prove that Russian intelligence directed the current campaign, nor do they\n\nestablish that all three organizations operated as a single group during the European incidents.\n\nAttribution Judgment For Claims By NoName057(16)\n\nNoName057(16) and Z-Pentest are credible investigative leads because of their reported claims, targeting\n\nhistories, and demonstrated interest in exposed industrial equipment. However, the available evidence does not\n\njustify assigning them responsibility with moderate or high confidence. Direct Russian state sponsorship of these\n\nattacks remains even less certain but would fit the pattern of attacks on the EU that have been taking place in\n\nrecent months. In line with this, the European Commission and ENISA's November 4 statement regarding the\n\nattacks reinforces the need for cross-border information sharing and coordinated mitigation.\n\nPage 10 of 15\n\nhttps://dti.domaintools.com/research/european-refrigeration-systems-cyber-sabotage\n\nFrench Government Attribution: IRGC Shahid Kaveh and the October 2026\n\nRefrigeration Attacks\n\nOn November 9, 2026, France formally attributed the October 11–12 cyberattacks against its commercial\n\nrefrigeration infrastructure to Shahid Kaveh, an offensive cyber unit operating within the Electronic and Cyber\n\nCentre of Iran's Islamic Revolutionary Guard Corps (IRGC). The attribution was published in technical\n\nintelligence report CERTFR-2026-CTI-009, prepared by France's interagency Cyber Crisis Coordination Centre\n\n(C4), which brings together ANSSI, COMCYBER, the DGA, DGSE, and DGSI.\n\nThe assessment identifies the IRGC as the organization directing the operation and Shahid Kaveh as the executing\n\nunit. This represents a significant development in an investigation previously characterized by competing\n\nhacktivist responsibility claims, uncertainty concerning initial access, and limited publicly available forensic\n\nevidence.\n\nFrench investigators additionally identified concurrent targeting of Schneider Electric equipment at small\n\nhydroelectric installations. C4 associated this activity with the refrigeration operation and reported moderate\n\neffects on the equipment. The inclusion of energy infrastructure suggests a broader industrial targeting effort\n\nextending beyond food refrigeration, although the public report does not disclose the affected facilities or the\n\nexact control functions manipulated.\n\nTechnical Evidence Supporting Attribution\n\nC4 describes its attribution as a convergence of technical and intelligence indicators rather than reliance on a\n\nsingle artifact. Four findings underpin the French assessment.\n\nAlleged Shared operational infrastructure. Infrastructure used to conduct the refrigeration attacks was\n\nalso employed during the same period for reconnaissance against Schneider Electric industrial equipment.\n\nThis is the most significant technical connection disclosed because it links the refrigeration operation with\n\nseparate industrial targeting activity associated with Shahid Kaveh.\n\nEstablished industrial reconnaissance methods. C4 reports that Shahid Kaveh has possessed scripts for\n\nscanning, and attempting to control Schneider Electric, Siemens, and Rockwell industrial equipment since\n\nat least June 2024. In April 2026, the unit conducted large-scale reconnaissance involving Modbus/TCP\n\nport 502 against Schneider Electric systems including targets in France. The French assessment identifies\n\nsimilar activities associated with the October campaign. Importantly, the report does not state that Modbus\n\nwas the exploitation protocol used against Danfoss refrigeration controllers.This is just a reference to\n\ntactics and operational details that are akin to the recent attacks.\n\nFOFA-assisted target discovery. Investigators determined that operators used the FOFA internet asset\n\ndiscovery platform during the refrigeration operation. FOFA is commonly used to identify publicly\n\naccessible network services and industrial management interfaces. Its presence is consistent with\n\nreconnaissance against exposed refrigeration controllers, although use of the platform alone is not\n\nsufficient for attribution because it is available to legitimate researchers and multiple threat actors.\n\nIranian-language and communications indicators. Investigators recovered traces of Farsi within the\n\nattack infrastructure used. C4 also identified coverage of the refrigeration attack by CyberbanNews on\n\nPage 11 of 15\n\nhttps://dti.domaintools.com/research/european-refrigeration-systems-cyber-sabotage\n\nOctober 13, describing the outlet as associated with Shahid Kaveh. These observations provide additional\n\ncircumstantial clues, but do not directly tie these actors to the attacks in question.\n\nTaken together, these indicators support France's attribution to Shahid Kaveh. However, the public report does not\n\nrelease the forensic artifacts required for independent technical reproduction. The attribution should therefore be\n\nidentified as a formal French interagency intelligence finding rather than an independently reproducible open-\n\nsource attribution.\n\nShahid Kaveh and Its Hacktivist Identities\n\nC4 places Shahid Kaveh within the IRGC's Electronic and Cyber Centre and identifies Mahdi Lashgarian and\n\nReza Salarvand as commanders of the unit. Its organizational annex separately identifies Hamid Reza Lashgarian\n\nas the head of the IRGC Electronic and Cyber Centre.\n\nThe report attributes Shahid Kaveh to several public-facing hacktivist identities, including CyberAveng3rs,\n\nSoldiers of Solomon, Mr. Soul, and Cyber Isnaad Front, as well as the communications outlet CyberbanNews.\n\nAccording to C4, these identities are used to publicly claim selected operations conducted by the unit.\n\nThis association is significant for the refrigeration investigation because Iranian-aligned actors have previously\n\nclaimed attacks against industrial controllers including Unitronics equipment in November 2023. C4 also reports a\n\nShahid Kaveh claim concerning a broader sabotage campaign against Israeli and American interests in March\n\nthrough April 2026, which reportedly involved Israeli refrigeration equipment.\n\nThe French attribution also complicates the interpretation of competing hacktivist claims. NoName057(16) and Z-\n\nPentest publicized alleged involvement in the European refrigeration disruptions during November, but C4's\n\nassessment attributes the October French operation to an Iranian state unit. Those later claims cannot be treated as\n\nproof that the Russian-aligned groups executed the October intrusion.\n\nIranian Media Activity and Potential Operational Signaling\n\nPage 12 of 15\n\nhttps://dti.domaintools.com/research/european-refrigeration-systems-cyber-sabotage\n\nMachine Translation: France has identified Iran as responsible for cyberattacks against refrigeration\n\nsystems, some of which resulted in fires.\n\nAccording to Cyberban's International Affairs Working Group, French officials have accused Iran's Islamic\n\nRevolutionary Guard Corps (IRGC) of carrying out a cyberattack last month that disrupted refrigeration systems\n\nat approximately 700 food retail stores in France.\n\nSubsequent open-source collections identified Iranian-language Telegram reporting about the attacks, including\n\nmaterial distributed through CyberbanNews. A recovered Persian-language item described manipulation of French\n\nrefrigeration systems, elevated temperatures, and disruption to food distribution. Separate Iranian-language\n\ncommentary portrayed the incident as evidence of European infrastructure vulnerability and warned of potential\n\nattacks against European infrastructure in the event of direct or indirect participation in military action against\n\nIran.\n\nPriority\n\nCritical\n\nCritical\n\nCritical\n\nHigh\n\nHigh\n\nDefensive Recommendations‍\n\nSecurity control\n\nInternet exposure\n\nassessment\n\nSecure remote\n\naccess\n\nAuthentication\n\nand access control\n\nFirmware and\n\nsecurity updates\n\nLegacy equipment\n\nisolation\n\nConsequently, the communications support the documented existence of Iranian-aligned interest and narrative\n\namplification, but do not independently establish the publisher's operational role.\n\nRecommended action\n\nIdentify all internet-accessible refrigeration\n\nmanagement interfaces, including systems\n\ninstalled or configured by third-party\n\nmaintenance contractors.\n\nRestrict administrative access to protected\n\ninternal networks or properly secured VPN\n\nconnections.\n\nRemove default credentials, enforce unique\n\nadministrative passwords, minimize\n\nprivileged access, and enable multifactor\n\nauthentication where supported.\n\nUpdate supported refrigeration controllers\n\naccording to manufacturer guidance and\n\napplicable security advisories.\n\nIsolate end-of-life refrigeration controllers\n\nand prioritize replacement with supported\n\nequipment.\n\nPage 13 of 15\n\nSecurity objective\n\nEliminate exposed attack\n\nsurfaces and unauthorized\n\nremote access paths.\n\nPrevent direct internet\n\naccess to industrial\n\nrefrigeration controllers.\n\nReduce credential-based\n\ncompromise and\n\nunauthorized\n\nadministrative activity.\n\nRemediate known\n\nvulnerabilities and reduce\n\nexploitation opportunities.\n\nReduce exposure from\n\nsystems that no longer\n\nreceive security updates.\n\nPriority\n\nHigh\n\nCritical\n\nHigh\n\nCritical\n\nSecurity control\n\nConfiguration\n\nintegrity\n\nmonitoring\n\nIndependent\n\ntemperature\n\nmonitoring\n\nIncident evidence\n\npreservation\n\nSecure restoration\n\nand recovery\n\nFinal Intelligence Assessment\n\nhttps://dti.domaintools.com/research/european-refrigeration-systems-cyber-sabotage\n\nRecommended action\n\nMonitor temperature setpoints, defrost\n\nschedules, alarm thresholds, and controller\n\nconfigurations for unauthorized changes.\n\nImplement temperature monitoring\n\nindependent of primary refrigeration\n\nmanagement controllers. Configure alerts for\n\nabnormal physical conditions.\n\nPreserve controller logs, configuration\n\nrecords, authentication events, and remote-\n\naccess telemetry before resetting affected\n\nsystems, whenever operational safety\n\npermits.\n\nVerify that exposed interfaces, compromised\n\ncredentials, and insecure remote-access\n\nconfigurations have been remediated before\n\nreconnecting restored equipment.\n\nSecurity objective\n\nDetect malicious\n\nmanipulation of\n\nrefrigeration operations.\n\nDetect unsafe conditions\n\neven when the primary\n\ncontroller is\n\ncompromised.\n\nMaintain forensic\n\nevidence for incident\n\nreconstruction and\n\nattribution.\n\nPrevent reinfection or\n\nrenewed unauthorized\n\naccess following a factory\n\nreset.\n\nThe October and November 2026 refrigeration attacks represent a significant example of cyber-enabled\n\ninterference with civilian operational technology. The incidents demonstrate how remotely accessible industrial\n\nmanagement systems can be manipulated to cause substantial physical and economic consequences without the\n\ndeployment of conventional malware or the need for exploits to access these types of systems.\n\nThe campaign has affected hundreds of French supermarkets, expanded across numerous European countries, and\n\nprompted a coordinated response from the European Union's principal cybersecurity organizations. Additional\n\nincidents involving British food-processing firms and French medical cold-storage infrastructure illustrate the\n\nbroader vulnerability of temperature-dependent civilian systems.\n\nThe available technical evidence increasingly supports weaknesses in remote administration and authentication as\n\nmajor contributors to the attacks. Known Danfoss vulnerabilities remain relevant to exposure management, but\n\ntheir exploitation has not been established as the cause of the incidents.\n\nNo verified attacker-controlled domain, VPN endpoint, proxy network, or common malicious source IP has been\n\npublicly identified. NoName057(16) and Z-Pentest have reportedly claimed responsibility, but the claim has not\n\nbeen independently substantiated and conflicts with C4’s attribution of the October France wave to Shahid Kaveh.\n\nWhile Russia's documented campaign of espionage, sabotage, and influence activity against Europe provides a\n\nPage 14 of 15\n\nhttps://dti.domaintools.com/research/european-refrigeration-systems-cyber-sabotage\n\ncredible strategic context for investigating Russian-aligned involvement, it does not establish Russian state\n\ndirection or operational control.\n\nFrance’s attribution, made without releasing forensic artifacts for independent verification, also muddies the\n\nwaters concerning what nation state actors, if any, were responsible for the attacks and what the goals might have\n\nbeen. Without independently verified evidence for either Russia’s or Iran’s involvement in these attacks, these\n\nevents may well just be non-state actors sowing chaos for fun.\n\nThe real lesson to be learned however, is that at present, the leading contention is that these systems were online\n\nand insecure by proxy of not being secured. Default configurations, passwords, and lack of alarms as well as\n\nlogging places these systems at greater security risk and as we have seen, create outsize financial and political\n\neffects when they are successfully attacked.\n\nThe principal conclusion remains that the European refrigeration incidents demonstrate a repeatable capability\n\nfor cyber-physical disruption against civilian infrastructure, while the precise perpetrators, coordination\n\nmechanisms, and strategic objectives remain unresolved.\n\nSource: https://dti.domaintools.com/research/european-refrigeration-systems-cyber-sabotage\n\nPage 15 of 15",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"OTX"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://dti.domaintools.com/research/european-refrigeration-systems-cyber-sabotage"
	],
	"report_names": [
		"european-refrigeration-systems-cyber-sabotage"
	],
	"threat_actors": [],
	"ts_created_at": 1794622297,
	"ts_updated_at": 1794622733,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/24989eb016bed25bba4e464befde1d0688afaedd.pdf",
		"text": "https://archive.orkl.eu/24989eb016bed25bba4e464befde1d0688afaedd.txt",
		"img": "https://archive.orkl.eu/24989eb016bed25bba4e464befde1d0688afaedd.jpg"
	}
}