Cold Chain Cyberattack: FBI and 4 Agencies Warn of Refrigeration Controller Exploits

The attack chain against Danfoss AK-SM refrigeration controllers has three distinct phases, each of which requires minimal attacker skill due to publicly documented weaknesses.

Phase 1: Discovery. Attackers use Shodan, Censys, and FOFA to search for internet-facing devices responding on port 80 or 443 with Danfoss AK-SM web management interface fingerprints. This takes seconds and costs nothing. Lupovis documented authentication attempts against their Danfoss AK-SM sensor honeypots beginning October 20, 2026, with a peak on October 26 during the French supermarket wave, confirming that automated scanning preceded targeted exploitation.

Phase 2: Authentication bypass. Two independent mechanisms allow access without valid credentials. The first is the documented default: Danfoss AK-SM controllers ship with username Supervisor and password 12345. These defaults are referenced in the AK-SM 800A installation manual, which is freely downloadable. The second mechanism is CVE-2025-41450, a CWE-305 authentication bypass formally documented by Claroty Team82 and published in CISA advisory ICSA-25-140-03. The bypass exploits a hidden "code of the day" maintenance function in which the controller accepts the device's current date, formatted in a specific pattern, as a valid bypass passcode regardless of the configured administrator password. CVSS v3.1 rates CVE-2025-41450 at 8.2 (High).

Phase 3: Temperature manipulation and persistence. Once authenticated, attackers use the web management interface to modify temperature setpoints, disable high-temperature alarms, and change configuration files. CVE-2025-41451 (CVSS unspecified, fixed in R4.3.1) enables command injection via the email configuration endpoint, which Tenable documented allows arbitrary OS command execution as root. CVE-2025-41452 affects the Nginx web server configuration on the controller, potentially enabling path traversal to reach files outside the web root.

MITRE ATT&CK ICS techniques T0817 (Drive-by Compromise), T0855 (Unauthorized Command Message), and T0828 (Loss of Safety) map directly to the documented attack phases.

The vulnerable controller population is larger than most IT security teams realize because OT assets are rarely included in vulnerability management scans.

Directly confirmed vulnerable (patch immediately):

Blast radius: Successful exploitation gives an attacker unauthenticated root-equivalent control over all temperature setpoints, alarm thresholds, and configuration on the controller, with no credentials and no user interaction required. Any perishable inventory managed by that controller is at immediate risk of spoilage.

The US advisory specifically names grocery retail and cold storage as the primary current targets, with healthcare (pharmacies, blood banks, hospital cold storage), military commissaries, chemical facilities, and food transportation as adjacent sectors with identical attack surfaces. Any organization in those sectors operating controllers in the CISA-named product families should treat this as an active threat to their specific environment, not a general industry warning.

The supply chain attacks against managed service infrastructure pattern documented earlier this year shows how attackers move laterally from one compromised vendor's infrastructure to all connected client environments. Cold chain attacks introduce a physical-world analogue: one compromised refrigeration controller in a distribution center can cascade temperature disruptions across an entire supply chain.

The 2026 cold chain attack campaign began on October 11, 2026, when an unattributed threat actor exploited internet-exposed Danfoss AK-SM controllers in 700+ French supermarkets simultaneously, manipulating refrigeration setpoints and disabling temperature alarms. France's Direction générale de la concurrence, de la consommation et de la répression des fraudes (DGCCRF) issued emergency food safety guidance. CERT-FR published alert CERTFR-2026-ALE-012 on October 12, confirming widespread compromises.

A second wave on November 2, 2026 extended the campaign to Belgium, Luxembourg, the Netherlands, Sweden, Estonia, Ireland, and Portugal, with over 100 additional stores reporting overnight refrigeration failures. Attribution remains unresolved as of this writing. No threat actor or group has been publicly identified by any national authority. The attack pattern, automated discovery and mass exploitation of default credentials on internet-exposed OT devices, is consistent with both criminal (ransomware precursor positioning) and state-linked (critical infrastructure disruption) actors.

SentinelOne Labs' "Defrost and Disrupt" assessment notes the campaign is methodologically similar to the 2021 Oldsmar water treatment attack, in which an attacker accessed a supervisory control system remotely using legitimate credentials and adjusted chemical dosing. Both incidents demonstrate that OT control systems exposed to the internet require no sophistication to compromise: publicly documented defaults and a web browser are sufficient.

The Pentagon separately confirmed in early November that it is examining freezer failures at US military commissaries in August 2026 as a potential related incident, though no attribution has been made. The critical infrastructure ransomware operations covered in October demonstrate that financially motivated actors increasingly target sectors with high-consequence physical systems, where the credible threat of disruption creates leverage independent of data encryption.

The 2026 cold chain campaign relies primarily on default credentials and known CVE exploitation rather than custom malware, so network-layer IOCs (C2 IPs, malicious domains) have not been publicly released. The indicators below focus on web server access patterns and configuration artifacts that indicate unauthorized access to Danfoss AK-SM controllers.

Lupovis honeypot telemetry documented authentication attempts against AK-SM interfaces beginning October 20 through October 26, with the attacking IP 188.208.141.210 appearing consistently in pre-attack scanning activity. This indicator is unverified and sourced from a single vendor blog; treat it as a hunting hypothesis rather than a confirmed block rule.

The primary detection surface is web server access logs on the controllers themselves, or on upstream reverse proxies and firewalls if the controllers sit behind them. Repeated authentication attempts against /AK-SM800A/admin from non-RFC1918 addresses, followed by HTTP 200 responses, indicate successful unauthorized access. A single successful authentication from an unexpected external IP should trigger immediate isolation.

Two rules cover the primary attack phases: external web interface access and command injection via the email configuration endpoint. Both carry experimental status; validate against your OT network log format before enabling automated blocking. Restrict alert generation to controllers in your OT/refrigeration VLAN to reduce false positives from unrelated web traffic.

The five-agency US advisory identifies network isolation as the single most effective immediate mitigation. Apply these steps in order, starting with segmentation before firmware patching if your patch window requires scheduling.

If a refrigeration controller in your environment authenticated successfully from an unexpected external IP, or if temperature setpoints changed without an authorized operator action, treat it as a confirmed compromise and follow these steps in order. Do not attempt to patch or reconfigure the controller before isolating it.

The 2026 cold chain campaign demonstrates that OT attack surfaces that were long considered theoretical threats have become operational priorities. Food retailers, healthcare organizations, and military logistics operators face physical consequences from these attacks that exceed what any data breach can produce: inventory destruction, regulatory fines, public health liability, and in the worst case, harm to end consumers.

The root cause is predictable: industrial refrigeration controllers were connected to the internet for remote monitoring convenience, never received the same hardening treatment as IT assets, and were left with factory defaults because OT firmware patching is operationally complex. Those decisions, made over years, produced the attack surface the European campaign exploited in one week.

The good news is that the defensive posture is well-defined and actionable. Network segmentation stops the primary attack vector entirely. Firmware R4.3.1 patches all three known CVEs. Default credential rotation takes under 30 minutes per controller. The five-agency US advisory issued yesterday provides the authority to prioritize this work over other scheduled maintenance.

The question for security teams is not whether cold chain controllers are worth protecting. The question is whether your organization discovers your exposure through a proactive audit or through a temperature alarm that fires 12 hours after an attacker has already set your freezers to 50 degrees Celsius.

Run the Shodan query for your IP ranges today. If any AK-SM results come back, treat it as a P1 until the controller is behind a VPN and running R4.3.1.