International
The Morning Dev

Only the news worth knowing

‹
 
D6/100

Incident · high

Attacks on refrigeration controllers in supermarkets attributed to Iran's Revolutionary Guards

Tier D · Background noise – Good to know

Who’s exposed: Internet-exposed industrial refrigeration and cold-chain controllers in supermarkets and cold storage

Tier D because: Does not hit tech teams

Reach

Attack

Damage

Fix

Exploited in the wild · Full takeover

What to do

  1. Take refrigeration controllers off the public internet, as the advisory recommends as its most basic fix
  2. Apply the basic security fixes described in the CISA and FBI joint advisory

The Brief

  • U.S. agencies CISA, FBI, HHS, USDA and the Department of Transportation issued a joint advisory on attacks against industrial refrigeration controllers.
  • Threat actors are reportedly targeting industrial refrigeration and cold-chain monitoring systems globally, aiming at service disruption, fire hazards and inventory loss.
  • SecurityScorecard found internet-exposed refrigeration controllers in supermarkets and cold storage being hijacked for a suspected spam botnet and proxy services.

Why it matters

Internet-exposed refrigeration controllers can be hijacked to disrupt operations, create fire hazards and destroy inventory, and they can also be abused as spam and proxy infrastructure.

The checklist behind the tier

Checklist · 2 of 10 yes
NoHits tech teamsJudgment: industrial refrigeration and cold-chain controllers are OT equipment, not software developers or IT teams run.
NoCore infrastructureJudgment: vendor refrigeration controllers are a niche product, not software nearly every team runs.
NoPopular toolJudgment: specialized industrial controllers, not a widely used framework, tool, platform, OS or package.
YesExploited in the wildThe Hacker News: threat actors are actively targeting these systems; Help Net Security: controllers are being hijacked for spam botnet.
NoPublic exploitNo source says exploit code or a step-by-step proof-of-concept has been published.
NoRemote, no loginSources say devices are internet-exposed, but no source states unauthenticated access is enough.
YesFull takeoverHelp Net Security: controllers are hijacked and turned into spam botnet and proxy infrastructure, implying control of the devices.
NoSecrets exposedNo source reports credentials, configs, source code or customer data being stolen or exposed.
NoSupply chainNo source reports malicious code shipped through a trusted developer channel such as a package, update or build pipeline.
NoNo fix yetSecurity Affairs says the fixes are basic and mainly involve removing devices from the internet; no source says no patch exists.

Timeline

  1. TechCrunch

    US government warns of ‘ongoing cyber threat’ amid mass hacks of industrial retail and military freezers

  2. The Record from Recorded Future News

    Harden cooling systems now, feds warn critical infrastructure operators amid attacks

  3. BleepingComputer

    FBI, CISA warn of cyberattacks targeting refrigeration systems

  4. Help Net Security

    US agencies warn attackers are targeting refrigeration systems that protect food and medicine

  5. Security Affairs

    ENISA Warns of Cyberattacks Targeting Refrigeration Systems Across Europe

  6. SecurityWeek

    US Agencies Urge Organizations to Harden Refrigeration Controllers

  7. Security Latest publishes analysis of escalating fridge-hacking attacks on blood labs and grocery stores

  8. Security Latest

    The Fridge-Hacking Spree Is an Internet-of-Things Wake-Up Call

  9. U.S. agencies publish joint advisory warning of attacks on industrial refrigeration controllers

  10. SecurityScorecard reports refrigeration controllers hijacked for suspected spam botnet and proxy traffic

  11. The Hacker News

    U.S. Agencies Warn Refrigeration Controller Attacks Could Cause Fires and Inventory Losses

  12. Security Affairs

    CISA and the FBI Warn Of Attacks against Industrial Refrigeration Controllers

  13. Help Net Security

    Hackers abuse refrigeration controllers to send spam and route proxy traffic

  14. Techmeme

    French officials say Iran's Revolutionary Guards were behind the cyberattacks that knocked out commercial refrigerators and freezers across France in October (Reuters)

  15. BleepingComputer

    France blames Iranian hackers for supermarket attacks that sparked fires

  16. The Record from Recorded Future News

    France blames Iran for fridge cyberattacks, says some caused fires

  17. Security Affairs

    France Blames Iran for the Supermarket Fridge Attacks

  18. TechCrunch

    France blames Iran for mass-hacks targeting freezers in grocery stores and blood banks

Full coverage · 15 sources

First seen · 15 sources · Full story page · How tiers are decided

Tier D: Attacks on refrigeration controllers in supermarkets attributed to Iran's Revolutionary Guards – The Morning Dev