🛡️ Threat Intelligence Report: European Refrigeration Controllers & Cold-Chain Sabotage Campaign

Report Date: 2026-11-04
Period Covered: August 2026 – November 3, 2026
Classification: TLP:WHITE
Severity: CRITICAL
Platform: TI Mindmap HUB — ti-mindmap-hub.com

1. Reports Summary Table

The following table lists all 11 TI Mindmap HUB reports analyzed for this cross-source assessment, covering national CERT alerts (CERT-FR, CSIRT-ITA/ACN), vendor security advisories (Copeland/Dixell), OT vulnerability & AI-exploitation research (Claroty Team82), internet exposure telemetry (Censys ARC), and threat intelligence assessments (SentinelOne SentinelLABS, BlackFog, Recorded Future / The Record, Nextgov/FCW).

2. Executive Summary

2.1 Overview

Between October and early November 2026, two major waves of cyber-physical attacks struck commercial refrigeration controllers, supermarket freezers, and food-distribution cold-chain facilities across Europe, following earlier suspected intrusions against U.S. military base commissaries in August 2026. Rather than deploying ransomware or exfiltrating corporate IT data, threat actors directly targeted internet-exposed Operational Technology (OT) and Building Management System (BMS) supervisory controllers—specifically Danfoss AK-SM 800A / AK-SM 8xxA / AK-SC Series (Danfoss StoreView), Copeland XWEB EVO / XWEB PRO, and Dixell XWEB units.

By accessing remote administration interfaces during overnight and early-morning hours, attackers manipulated operational parameters, forced refrigeration cabinets and walk-in cold rooms into prolonged defrost cycles, suppressed temperature alarms, locked out local administrators, and drove freezer temperatures up to 50°C (122°F). The resulting thermal excursions caused tens of millions of euros in spoiled meat, dairy, and frozen inventory, forced store closures, triggered localized equipment fires in France, and necessitated physical hardware modifications on legacy controllers in Belgium.

Cross-source correlation across all 11 TI Mindmap HUB reports reveals a systemic OT security crisis in the food distribution and cold-chain sector:

1. Wave 1 — French Supermarket Sabotage (October 10–13, 2026): Between 350 and 700 retail locations in France (including Intermarché, Carrefour, Coopérative U, Monoprix, Leclerc, and Netto) suffered overnight refrigeration sabotage. Prior to the attack on October 11, France hosted 61% (1,825 hosts) of all internet-exposed Danfoss StoreView interfaces worldwide, with 63.5% (1,158 hosts) running firmware older than v4.2.
2. Inter-Wave Reconnaissance (October 20–30, 2026): Threat deception provider Lupovis recorded a surge of automated access attempts and default-credential spraying against Danfoss refrigeration controller sensors between October 20 and October 30, peaking on October 26, 2026, alongside active enumeration of controller components.
3. Wave 2 — Pan-European Cold-Chain Expansion (November 1–3, 2026): Over 100 supermarkets, butcher chains, and grocery stores across at least nine European countries—Belgium (>50 stores), Sweden, the Netherlands, Luxembourg, Ireland, Estonia, Italy, Portugal, Germany, and anomalies under investigation in Finland—experienced identical overnight temperature manipulation up to 50°C. Affected chains included ICA, Coop, Delhaize, Carrefour, Spar, SuperValu, Selver, and Kesko.
4. Converging Vectors (Weak/Default Credentials vs. Unpatched CVEs & Shared Maintainers): While Claroty Team82 disclosed a critical unauthenticated-to-root exploit chain in Danfoss AK-SM 800A controllers (CVE-2025-41450 + CVE-2025-41451) and demonstrated that an AI coding agent could reproduce the full root exploit in 28 minutes for $6, ANSSI Director Vincent Strubel stated that the French intrusions primarily abused internet-exposed management interfaces, discontinued End-of-Life (EoL) hardware, and weak or factory-default credentials (such as Admin/Admin on XWEB systems), alongside potential shared third-party HVAC/R maintenance access observed in Germany and Portugal.

2.2 Diagram: Attack & Cold-Chain Sabotage Flow

┌──────────────────────────────────────────────────────────────────────────────┐
│           EUROPEAN REFRIGERATION & COLD-CHAIN SABOTAGE ATTACK FLOW           │
├──────────────────────────────────────────────────────────────────────────────┤
│                                                                              │
│  1. RECONNAISSANCE & TARGET DISCOVERY (Shodan / Censys / Scanning)           │
│  ┌────────────────────────────────────────────────────────────────────────┐  │
│  │ • Locate internet-exposed OT supervisory panels (~2,765 → 1,000+ hosts)│  │
│  │ • HTTP Title: "Danfoss StoreView" / "Danfoss – StoreView Web" / "XWEB" │  │
│  │ • Fingerprint firmware via HTTP Last-Modified header & Lupovis probes  │  │
│  └───────────────────────────────────┬────────────────────────────────────┘  │
│                                      │                                       │
│  2. INITIAL ACCESS (3 Parallel Paths)▼                                       │
│  ┌────────────────────────┐ ┌──────────────────────┐ ┌────────────────────┐  │
│  │ Path A: Credential     │ │ Path B: Vulnerability│ │ Path C: Third-Party│  │
│  │ Abuse (Primary in Wild)│ │ Exploitation Chain   │ │ Maintenance Pivot  │  │
│  │ • Exposed Web / SSH    │ │ • CVE-2025-41450     │ │ • Shared HVAC/R    │  │
│  │ • Default "Admin/Admin"│ │   (xml.cgi date code)│ │   contractor VPNs, │  │
│  │ • Weak passwords on    │ │ • CVE-2025-41451     │ │   cellular routers,│  │
│  │   EoL XWEB EVO / AK-SC │ │   (SMTP 0x1be1 RCE)  │ │   AnyDesk/jump host│  │
│  └───────────┬────────────┘ └──────────┬───────────┘ └─────────┬──────────┘  │
│              └─────────────────────────┼───────────────────────┘             │
│                                        │                                     │
│  3. INHIBIT RESPONSE & DEFENSE EVASION ▼                                     │
│  ┌────────────────────────────────────────────────────────────────────────┐  │
│  │ • Execute overnight / early morning (00:00–05:00) to delay response    │  │
│  │ • Change administrator passwords / lock out local store staff (T1531)  │  │
│  │ • Create rogue local profiles & modify alarm routing/thresholds (T0838)│  │
│  │ • Suppress email/SMS notifications & manipulate telemetry view (T0878) │  │
│  │ • Optional DoS via Nginx headers.conf crash of sm_app (CVE-2025-41452) │  │
│  └───────────────────────────────────┬────────────────────────────────────┘  │
│                                      │                                       │
│  4. IMPAIR PROCESS CONTROL           ▼                                       │
│  ┌────────────────────────────────────────────────────────────────────────┐  │
│  │ • Force refrigeration racks & cold rooms into continuous DEFROST mode  │  │
│  │ • Override temperature setpoints up to +50°C (+122°F) (T0836 / T0855)  │  │
│  │ • Alter relay activation rules, compressor schedules & fan controls    │  │
│  └───────────────────────────────────┬────────────────────────────────────┘  │
│                                      │                                       │
│  5. PHYSICAL & ECONOMIC IMPACT       ▼                                       │
│  ┌────────────────────────┐ ┌──────────────────────┐ ┌────────────────────┐  │
│  │ Cold-Chain Breakdown   │ │ Financial & Retail   │ │ Safety & Hardware  │  │
│  │ • Spoiled meat, dairy, │ │ Disruption           │ │ Consequences       │  │
│  │   and frozen stock     │ │ • 700+ French stores │ │ • Localized store  │  │
│  │ • Mandatory food-safety│ │ • 100+ stores in 9+  │ │   fires in France  │  │
│  │   disposal across EU   │ │   EU nations         │ │ • Physical hardware│  │
│  │ • 6 U.S. military base │ │ • Tens of millions € │ │   rewiring needed  │  │
│  │   commissaries hit     │ │   in inventory loss  │ │   on legacy units  │  │
│  └────────────────────────┘ └──────────────────────┘ └────────────────────┘  │
└──────────────────────────────────────────────────────────────────────────────┘

2.3 Attribution & Threat Actor Landscape

Across all 11 analyzed reports, no threat actor has publicly claimed responsibility for the October–November 2026 European supermarket attacks, and European law enforcement (including the Paris Prosecutor's Office and Belgium's Federal Prosecutor) has not issued formal attribution. However, cross-source intelligence highlights three distinct investigative clusters and historical precedents:

Historical Lineage of Refrigeration Attacks:

• 2022 (Russia & Israel): Danfoss documented cyberattacks affecting 16 supermarkets in Russia (shortly after the invasion of Ukraine) and ~40 supermarkets in Israel, where devices lacked firewall or VPN protection.
• November 2024 (United States): CARR compromised refrigeration controls at a Los Angeles meat-processing plant, spoiling inventory and triggering a hazardous ammonia leak.
• Late August 2026 (United States): Freezers malfunctioned at six U.S. military base commissaries in suspected Iran-linked intrusions.
• October 10–13, 2026 (France — Wave 1): 350 to 700 French retail stores hit overnight; units forced into defrost mode up to 50°C, causing widespread food spoilage and localized fires.
• November 1–3, 2026 (Pan-Europe — Wave 2): 100+ stores across 9+ European countries (Belgium, Sweden, Netherlands, Luxembourg, Ireland, Estonia, Italy, Portugal, Germany, and anomalies in Finland) hit overnight with identical 50°C temperature manipulation.

3. Detailed Cross-Source Analysis

3.1 Converging Intelligence Across All 11 Sources

• Living-off-the-Land in OT (No Custom Malware Required): All sources agree that attackers did not need bespoke OT wiper malware. Commercial refrigeration supervisory controllers are designed to centralize temperature setpoints, defrost schedules, compressor relays, and alarm routing. Once administrative access is obtained, legitimate built-in web functions are sufficient to turn cooling units into heaters (up to 50°C) and silence alarms.
• Overnight Execution Timing: Both Wave 1 (Sunday night October 11–12) and Wave 2 (Sunday/Monday night November 1–3) were executed during overnight or early-morning hours when stores were unstaffed, maximizing thermal soak time and ensuring perishable stock crossed food-safety thresholds before morning shifts arrived.
• Multi-Vendor Legacy Debt: While early press coverage focused solely on Danfoss, official alerts from CERT-FR (CERTFR-2026-ALE-012), CSIRT Italia (BL01/261013/CSIRT-ITA), Copeland (XWEB Advisory), and The Record confirm that Danfoss (AK-SM / AK-SC / StoreView), Copeland (XWEB EVO / PRO), and Dixell (XWEB) controllers were all impacted or at high risk due to End-of-Life (EoL) status and direct internet exposure.
• Irreversible Physical & Food-Safety Impact: CSIRT Italia (Report #3) and Copeland (Report #1) emphasize a critical cold-chain principle: restoring display temperatures to normal does not render food safe once thermal limits have been breached, and manipulated supervisory displays (T0832 Manipulation of View) cannot be trusted without physical thermometer verification. Furthermore, Belgian contractor Sabcobel (Report #4) revealed that around 20 affected legacy units in Belgium could not be secured via software alone and required physical on-site hardware modifications.

3.2 Diverging Perspectives & Nuances

• Exploited CVEs vs. Weak Passwords: Early technical commentary pointed to Claroty Team82's August 2026 disclosure of Danfoss AK-SM 800A vulnerabilities (CVE-2025-41450, CVE-2025-41451, CVE-2025-41452). However, SentinelLABS (Report #8) highlights that ANSSI Director Vincent Strubel attributed the French compromises primarily to exposed administration interfaces combined with weak or default passwords rather than zero-day or complex exploit chains. Conversely, Censys (Reports #5, #6) notes that 63.5% of exposed French Danfoss hosts on October 11 were running firmware below v4.2, leaving them simultaneously vulnerable to the trivial date-based CVE-2025-41450 authentication bypass.
• Direct Internet Exposure vs. Third-Party Contractor Pivot: While Censys, CERT-FR, and Copeland focus on controllers exposed directly via port forwarding, DMZ placement, or public IPv4 addresses, SentinelLABS (Report #8) and CSIRT Italia (Report #3) surface a second critical vector: shared third-party maintenance providers. Operators in Germany and Portugal reported that affected refrigeration systems were managed by external contractors with remote access across multiple retail chains, raising the possibility of supply-chain/contractor-gateway compromise alongside direct Shodan/Censys scanning.

4. Technical Details

4.1 Affected Platforms & Architecture

Danfoss AK-SM 800A Internal Web Architecture (per Claroty Team82, Report #10)

When an HTTP/HTTPS request reaches an exposed Danfoss AK-SM 800A controller:

1. External Nginx Reverse Proxy: Terminates external HTTP/S connections and routes .cgi requests to the FastCGI binary sm_fcgi_app.
2. FastCGI Handler (sm_fcgi_app): Parses request routing rules from sm_fcgi_app.conf and forwards XML API payloads via forward_xml_request to an internal loopback Nginx listener.
3. Core Application Binary (sm_app — 67 MB binary): Hosts the Task_Web service, which parses XML actions (such as xml.cgi with action="getauth" or action="load_nginx_headers"), manages user authentication, updates configuration items (such as item 0x1be1), and issues physical control commands to connected refrigeration cabinets and compressors.

4.2 Vulnerability Analysis (Danfoss & Copeland/Dixell)

4.3 AI-Accelerated Exploit Reproduction (Claroty Team82 Experiment, Report #9)

Following the October 11–12 French supermarket attacks, Claroty Team82 conducted a landmark experiment to measure how quickly modern AI coding agents could weaponize public OT vulnerability disclosures:

• Setup: Researchers used Anthropic Claude Sonnet 4.6 (in medium-reasoning mode) inside the Cursor IDE, providing only public CVE descriptions (CVE-2025-41450, CVE-2025-41451, CVE-2025-41452), publicly downloadable Danfoss firmware (available from Danfoss's website without login or encryption), and a Ghidra MCP integration to decompile the 67 MB sm_app binary.
• Outcome: After a single human correction when the agent initially misidentified the CVE-2025-41450 code-of-the-day path, the AI agent reverse-engineered the daily code algorithm, reproduced all three CVEs, and chained CVE-2025-41450 + CVE-2025-41451 to achieve unauthenticated root RCE on a physical lab controller in 28 minutes at a total API cost of ~$6.
• Strategic Implication: Security-by-obscurity in industrial and building-control firmware is obsolete. Once firmware and CVE summaries are public, low-resourced threat actors can generate working OT exploits in minutes.

4.4 Internet Exposure & Firmware Telemetry (Censys ARC Analysis, Reports #5 & #6)

Censys researchers tracked global internet exposure of Danfoss StoreView and Danfoss – StoreView Web interfaces across both attack waves, fingerprinting exact firmware versions by matching the HTTP Last-Modified header of html/index.html against official Danfoss .spk firmware build timestamps:

French & Global Exposure Drop (Wave 1 to Wave 2)

• August 2026 Baseline (Claroty / Censys): 2,765 publicly exposed Danfoss StoreView hosts globally.
• October 11, 2026 (Wave 1 Outbreak): 2,991 exposed hosts globally, with France hosting 61% (1,825 hosts)—of which 1,158 (63.5%) ran firmware < 4.2 (vulnerable to all 3 CVEs), 191 (10.5%) ran 4.2.4 (vulnerable to RCE/DoS), and only 475 (26.0%) ran patched >= 4.3.1.
• October 14, 2026 (Post-CERT-FR Alert): French exposure dropped by 71% to 537 hosts (while rest-of-world dropped only 17%, from 1,166 to 966). Because patched and unpatched hosts disappeared at identical rates, Censys concluded operators disconnected controllers from the internet rather than patching them in place.
• November 2, 2026 (Wave 2 Outbreak): Global exposure stood at ~1,000+ hosts, with France down to 220 hosts (88% reduction from October 11).

Country-by-Country Firmware Posture (November 2, 2026 — Censys Report #6)

Note on Global Firmware Distribution: Across all exposed controllers globally in October 2026, the most common versions were legacy v3.3.0 (560 hosts), patched v4.3.1 (511 hosts), and legacy v3.2.6 (437 hosts), alongside obsolete 2020–2021 SMG09 builds and versions 3.0.12, 3.1.11, 4.0.14, and 4.1.4—even though current Danfoss firmware was v5.3.2.

5. Detection Opportunities & Hardening Guidance

5.1 Attack Surface & Exposure Discovery

Defenders should immediately audit external IP space, NAT/port-forwarding rules, DMZ segments, and cellular/4G/5G maintenance routers for exposed refrigeration management panels:

• Censys Search Query (Danfoss StoreView):

  host.services.endpoints.http.html_title = "Danfoss StoreView" or host.services.endpoints.http.html_title = "Danfoss – StoreView Web"
  

• External Cellular Verification (Copeland / Dixell XWEB): Test reachability of XWEB web and SSH interfaces from an external network (e.g., mobile phone with Wi-Fi disabled). The XWEB login page must never be reachable from the public internet.
• Firmware Verification Caveat: Do not rely on the version number printed on the Danfoss login web page (which often reflects only the web UI package). Verify the true firmware version locally or via the HTTP Last-Modified header of html/index.html (for official patched firmware SM800A-4.3.1.spk, html/index.html bears timestamp 2025-07-31 08:18:58 UTC).

5.2 Application & Network Detection Rules (Danfoss AK-SM 800A)

• CVE-2025-41450 (Code-of-the-Day Auth Bypass): Inspect HTTP/HTTPS logs on the external Nginx proxy and sm_fcgi_app for requests to /xml.cgi with action="getauth" containing undocumented XML attributes or producing administrative logins not tied to known operator accounts.
• CVE-2025-41451 (SMTP Command Injection): Audit configuration changes to item 0x1be1 (SMTP email authentication password) for shell metacharacters (;, |, &, `, $()), unexpected outbound connections from the controller OS, or anomalous child processes spawned by sm_app.
• CVE-2025-41452 (Nginx Config Injection & DoS): Alert on any requests invoking action="load_nginx_headers", modifications to headers.conf, runtime Nginx reload events, or repeated crashes/restarts of the sm_app / Task_Web service.

5.3 Behavioral, OT Process & Configuration Detections (All Controllers)

Because attackers primarily abuse legitimate supervisory functions, CSIRT Italia (BL01/261013/CSIRT-ITA), CERT-FR (CERTFR-2026-ALE-012), and Copeland mandate behavioral and configuration auditing:

1. Thermal & Defrost Process Anomalies:
   • Immediate high-priority alerting on refrigeration or freezer setpoints modified above safe thresholds (especially setpoints raised toward +50°C / +122°F).
   • Unscheduled, prolonged, or simultaneous defrost cycle activations across multiple cabinets or stores, particularly between 00:00 and 06:00 local time.
   • Discrepancies between supervisory HMI displayed temperatures and independent physical probes (T0832 Manipulation of View).
2. Account, Lockout & Alarm Tampering:
   • Unexpected administrator password changes locking out local store staff (T1531).
   • Presence of unknown local user accounts or profiles on XWEB or AK-SM units (T1136.001).
   • Disabled alarm categories, altered relay activation rules, modified SMTP/DNS/gateway settings, or removed SMS/email alert recipients (T0838 / T0878).
3. 90-Day Cross-Layer Log Correlation (CSIRT-ITA Guidance):
   • Preserve and correlate up to 90 days of controller, SCADA/HMI, VPN, firewall, NAT, and remote-support logs prior to performing factory resets.
   • Audit third-party HVAC/R maintenance accounts, shared contractor VPN tunnels, and always-on store workstations running remote-support tools (AnyDesk, TeamViewer).

5.4 Remediation, Recovery & Hardening Playbook

6. Conclusion

The October–November 2026 cyberattacks against European supermarket refrigeration controllers and cold-chain facilities represent a watershed moment for Operational Technology security in the retail and food-distribution sectors. Across more than 800 impacted locations in at least 10 European countries (plus six U.S. military commissaries), adversaries demonstrated that catastrophic physical and financial disruption—spoiling millions of euros in perishable food and triggering store fires—can be achieved overnight without deploying a single line of custom malware.

The convergence of thousands of internet-exposed supervisory interfaces (Danfoss StoreView, Copeland/Dixell XWEB), widespread End-of-Life hardware lacking security updates until the EU Cyber Resilience Act (CRA) takes full effect in December 2027, unchanged factory credentials (Admin/Admin), shared third-party maintenance pathways, and AI coding agents capable of turning public firmware into working root exploits in 28 minutes for $6 has permanently eliminated obscurity as a defense. Food distribution, cold-chain logistics, and retail operators must treat refrigeration and BMS controllers as critical infrastructure: immediately severing direct internet exposure, enforcing strict IT/OT VLAN segmentation and MFA-backed contractor access, upgrading Danfoss firmware to R4.3.1+ (5.3.2), and accelerating the retirement of unsupported legacy controllers.

7. Indicators of Compromise & Exposure (IoC List)

Because the attacks leveraged built-in supervisory management functions over exposed interfaces rather than deploying persistent malware payloads, no attacker C2 IP addresses or malware hashes have been publicly released. Defenders should hunt using the following application-level exploit artifacts, exposure fingerprints, reference hashes, and behavioral IoCs consolidated from all 11 reports.

7.1 Application & Protocol Exploit Artifacts (Danfoss & Copeland/Dixell)

7.2 Exposure Fingerprints & Reference Hashes

7.3 Behavioral & OT Process Indicators

7.4 Vulnerability & Official Advisory Identifiers

8. MITRE ATT&CK Techniques (Enterprise & ICS Matrices)

The following table consolidates all MITRE ATT&CK Enterprise and MITRE ATT&CK for ICS techniques mapped across the 11 TI Mindmap HUB reports.

8.1 MITRE ATT&CK for ICS Techniques

8.2 MITRE ATT&CK Enterprise Techniques

Report generated by TI Mindmap HUB — Cross-source Threat Intelligence Analysis
Analysis date: 2026-11-04 | Sources analyzed: 11 | Classification: TLP:WHITE