TL;DR
Get backup power and energy gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Cybersecurity company Lupovis says it detected more than 276 attempts to authenticate with Danfoss AK-SM refrigeration controllers between October 20 and the end of the month. The attempts came from 91 threat actors and often used publicly documented factory-default credentials. The report does not establish that the attempts succeeded or that they caused the cyberattacks reported the following week.
Cybersecurity company Lupovis says it detected more than 276 authentication attempts targeting Danfoss AK-SM refrigeration controllers during a 10-day period beginning October 20, shortly before a reported wave of cyberattacks. The Glasgow-based company said the activity involved 91 different threat actors and peaked on October 26; its findings do not confirm that any attempted logins succeeded or that the activity caused the later attacks.
According to the report published by Cooling Post, Lupovis identified activity matching specific components of Danfoss refrigeration controllers. The company described it as reconnaissance and said the attempts stopped by the end of October. Most adversaries tried to authenticate using publicly documented factory-default usernames and passwords, a practice that can expose devices whose original credentials have not been changed.
The report does not provide a breakdown of successful versus failed logins, identify affected operators or facilities, or say whether any controller was altered. It also does not specify whether the observed attempts came from separate people or groups acting independently. The count of 91 threat actors is Lupovis’s characterization of the activity.
The report places the observations in the days leading up to a spate of cyberattacks the following week. That timing is confirmed in the account, but a connection between the controller probing and those attacks is not established. No attribution of the later incidents to the actors detected by Lupovis is given.
Risks to Connected Cooling Systems
Refrigeration controllers can manage equipment used in commercial and industrial cooling. Attempts to access them matter because unauthorized changes or disruption could affect system operation. The report, however, does not say that any refrigeration service was disrupted, that food or other goods were put at risk, or that an attacker gained control of a system.
The reported use of default credentials points to a specific security concern for operators: publicly known login details can be tried remotely when devices are reachable online. The findings may prompt organizations to review which controllers are exposed, change factory-set passwords and check access logs. Those are prudent security steps, not evidence that a breach occurred in this case.
The broader figures cited by another cybersecurity company indicate that internet-facing refrigeration services are distributed across many countries and product groups. Exposure counts describe observable services and addresses, however; they do not show how many systems were compromised or how many operators were affected.
Products Worth Considering
Arlo Pro Wireless Security Camera, 2K HDR, 6th Generation, 4-Camera System
LEVOIT Vital 200S-P Smart Air Purifier for Large Rooms up to 1875 ft², Quiet 27 dB Operation, AHAM VERIFIDE Certified, Air Quality Monitor,
Arlo Essential Wireless Security Camera 2K (3rd Gen), 3-Camera Set with Yard Sign
As an affiliate, we earn on qualifying purchases.
Earlier Scanning and Exposure Findings
Forescout Technologies previously reported tracking and identifying more than 20 claimed attacks against refrigeration systems since January. It named Z-Pentest Alliance and NoName057(16), which it described as pro-Russian, as the most active groups behind those claimed attacks. Those are Forescout’s findings and characterizations; the source report does not connect either group to the activity Lupovis detected.
Forescout also identified 12,976 internet-exposed service observations across 10 product groups, associated with 6,017 distinct public IP addresses in 99 countries and territories. Its reported counts included 7,075 Copeland/Dixell XWEB services, 4,697 Danfoss StoreView services, 551 Copeland Site Supervisor services, 513 Carel pCOWeb services and 140 services across six other product groups. These are observations of exposed services, not confirmed compromises, and the figures cover products beyond the Danfoss AK-SM controllers in Lupovis’s report.
“The company detected over 276 attempts coming from 91 different threat actors.”
— Lupovis, as reported by Cooling Post
No Confirmed Link to Later Attacks
It remains unknown whether any of the 276 attempts succeeded, which organizations or sites were targeted, or whether the activity caused changes to refrigeration systems. Lupovis’s report does not provide technical indicators, a list of affected IP addresses or evidence tying the detected actors to the subsequent cyberattacks.
The relationship between the two events is also unclear. Their timing places the controller activity before the reported attacks, but sequence alone does not establish that the same actors were responsible or that the earlier probing enabled later intrusions. Forescout’s counts of claimed attacks and exposed services are separate findings and do not settle that question.
Further Incident Details Needed
Further reporting from Lupovis, affected organizations or relevant authorities would be needed to establish whether any access was successful and whether the observed attempts were connected to the later attacks. Details such as incident timelines, affected systems and confirmed indicators could clarify the scope and attribution.
In the meantime, operators can review remote access to refrigeration controllers, replace factory-default credentials, restrict internet exposure where possible and examine security logs for unusual authentication activity. The source report does not say whether specific operators have taken these steps or whether investigations are under way.
Key Questions
What did Lupovis detect?
Lupovis reported more than 276 authentication attempts against Danfoss AK-SM refrigeration controllers over a 10-day period starting October 20. It said the attempts came from 91 threat actors and peaked on October 26.
Were any refrigeration controllers confirmed compromised?
The report does not confirm successful logins, compromised controllers or disruption to refrigeration services. It describes attempted authentication and reconnaissance.
Were the detected attempts linked to the later cyberattacks?
No link has been established in the reported information. The activity occurred beforehand, but the source does not attribute the later attacks to Lupovis’s detected actors.
What did Forescout report separately?
Forescout said it had tracked more than 20 claimed attacks against refrigeration systems since January and identified 12,976 internet-exposed service observations across 10 product groups and 99 countries and territories. These observations are not a count of confirmed compromises.
What remains unknown about the October activity?
The report does not identify affected operators or sites, say whether attempts succeeded, or provide evidence connecting the activity to the subsequent attacks. It also does not describe any confirmed operational impact.
Source: coolingpost.com
