An update to my post on hackers defrosting supermarket freezers. This story got a lot bigger today.
What’s new
- Joint U.S. advisory: CISA, FBI, HHS, USDA and DOT warn that attackers are going after industrial refrigeration and cold-chain controllers worldwide, forcing nonstop heating and defrost cycles. That means spoiled inventory, fire hazards and unsafe food or medicine.
- France names Iran: the French foreign ministry blamed Shahid Kaveh, an IRGC-linked cyber unit, for the Oct. 11-12 attacks. About 700 retail locations were hit, at least 15 fires were sparked, and losses run to tens of millions of euros. CERT-FR also tied attacks on Schneider Electric gear at small hydro plants to the same campaign.
- Botnet angle: SecurityScorecard found exposed Copeland XWEB PRO controllers (originally Dixell) being used to send spam and route proxy traffic.
What to do
The advisory’s list is the basics: find anything internet-facing, put OT behind a firewall, change default passwords, patch, kill unneeded remote access and replace legacy units. If a fridge controller has a public IP, fix that today.
God Bless, and Happy hacking!
References & Further Reading
- U.S. Agencies Warn Refrigeration Controller Attacks Could Cause Fires and Inventory Losses (The Hacker News)
- France blames Iranian hackers for supermarket attacks that sparked fires (BleepingComputer)
- Hackers abuse refrigeration controllers to send spam and route proxy traffic (Help Net Security)
- Hackers Defrost Freezers at 115+ European Supermarkets (EtherNinja)
- Hackers Cranked Up the Heat on French Blood Storage (EtherNinja)
