Internet-exposed industrial refrigeration controllers deployed across supermarkets and cold storage facilities are being co-opted into malicious infrastructure. Threat actors have hijacked the units to route unauthorized proxy traffic, relay spam campaigns, and tamper with temperature setpoints, leading to physical damage across European supply chains.

As reported by Help Net Security, telemetry analyzed by SecurityScorecard revealed that compromised Copeland XWEB PRO devices—originally manufactured by Dixell—are operating as internet-facing pivot points. The controllers, which run on embedded Linux systems to supervise commercial chillers and freezers, routinely lack standard endpoint monitoring and logging.

Repurposing Refrigerators for Spam and Proxy Routing

SecurityScorecard's STRIKE threat intelligence team discovered the activity after analyzing internet scan data and inspecting traffic originating from exposed XWEB panels. Investigators flagged nine IP addresses that initiated outgoing Simple Mail Transfer Protocol (SMTP) traffic on November 2 without receiving inbound mail, three of which were confirmed as XWEB units through their web interface titles and TLS certificates.

The three active units shared approximately 47% of their outbound email targets, with 508 out of 1,041 target addresses receiving messages from more than one controller. Researchers noted that this degree of destination overlap indicates a single, coordinated operator rather than unrelated spammers, though definitive command-and-control (C2) links remain unconfirmed.

Other exposed controllers were repurposed for proxy routing rather than email abuse. One unit located in Namibia served as a tunnel gateway, accounting for 71% of all traffic observed in the researcher's dataset. A separate controller in Trinidad and Tobago established connections to 10,643 unique external hosts within a 17-hour window, functioning as a residential proxy exit node.

Vulnerabilities and Default Credential Exploitation

SecurityScorecard assessed that attackers likely gained access using CVE-2026-25085, a security flaw that bypasses the controller's login authentication checks. The vulnerability is one of 23 security issues originally disclosed by Claroty Team82 and detailed in an advisory published by the Cybersecurity and Infrastructure Security Agency (CISA) in February.

However, software exploits are not always necessary to compromise these systems. An analysis published by Ransom-ISAC documented an intrusion at an unnamed commercial refrigeration facility where attackers manipulated an XWEB Pro unit on November 2 using standard factory default Administrator credentials.

In that incident, two administrative sessions originating from IP addresses in Australia and the Netherlands reconfigured 31 devices and executed 743 parameter changes. The intruders pushed system setpoints to extreme levels between 110°C and 150°C, suppressed system alarms, and locked local physical keypads to prevent on-site overrides.

Widespread Tampering Across European Facilities

The abuse of refrigeration equipment aligns with an ongoing wave of physical disruptions across Europe. In October, hundreds of supermarkets in France were forced to discard spoiled inventory after unauthorized actors gained access to their cooling systems overnight and turned on heating cycles. Danfoss, Dixell, and Copeland systems were all targeted in the French incidents.

Subsequent disruptions struck retail food stores across Belgium, Luxembourg, Sweden, Finland, Ireland, Estonia, and the Netherlands. The French Blood Establishment (EFS) also confirmed that cold rooms at three regional blood banks suffered temperature spikes after an external refrigeration maintenance vendor suffered a network intrusion.

Attribution remains unverified. Pro-Russian hacktivist groups NoName057(16) and Z-Pentest claimed credit for the supermarket disruptions on November 4. However, investigators have not validated those claims, and Ransom-ISAC confirmed it found no definitive links tying the physical tampering, the blood bank incidents, or the spam botnet operations to a single adversary.

What You Should Do

Organizations operating industrial refrigeration systems, food storage facilities, or related building management systems should immediately audit their operational technology (OT) footprint.

  • Remove public internet access: Isolate refrigeration controllers, energy management panels, and industrial controllers behind secure virtual private networks (VPNs) or dedicated firewalls, disallowing direct inbound connections from the public internet.
  • Reset factory credentials: Audit all deployed Copeland, Dixell, and third-party refrigeration devices to ensure default Administrator usernames and passwords have been replaced with complex, unique credentials.
  • Apply security patches: Review the CISA advisory regarding Copeland XWEB vulnerabilities and install firmware updates that mitigate CVE-2026-25085 and related authentication flaws.
  • Enforce egress filtering: Block unexpected outbound traffic from operational subnets. Refrigeration panels have no legitimate business requirement to initiate outbound SMTP connections or establish thousands of external proxy connections.
  • Audit third-party access: Review remote maintenance access granted to external refrigeration vendors, ensuring external connections require multi-factor authentication and strict network boundaries.