Hackers abuse refrigeration controllers to send spam and route proxy traffic

SecurityScorecard has identified that internet-exposed refrigeration controllers, specifically Copeland XWEB PRO units, are being hijacked and repurposed as part of a suspected spam botnet and for proxy services. This development underscores the vulnerabilities inherent in connected industrial systems, which often lack timely security updates.

The Copeland XWEB PRO units, originally manufactured by Dixell, are used in supermarkets and cold storage facilities to manage refrigeration systems. These controllers allow technicians to remotely monitor and adjust temperatures, but their connectivity has made them targets for attackers. SecurityScorecard's STRIKE team began their investigation by analyzing internet scan data and network traffic, which revealed that some of these controllers were being used to send outgoing emails without receiving any, an unusual behavior for legitimate mail servers.

The investigation identified nine IP addresses that were involved in this activity, with three confirmed as XWEB controllers based on their TLS certificates or web interface titles. These controllers were found to be part of a coordinated operation, as evidenced by the overlap in email targets. Approximately 47% of the email targets were shared among the three busiest nodes, suggesting a single operator rather than independent spammers. Additionally, two other controllers were used differently: one in Namibia as a tunnel gateway and another in Trinidad and Tobago as a residential proxy exit point.

The exploitation likely occurred through CVE-2026-25085, a vulnerability in the controller's login mechanism that allows unauthorized access. This flaw, among 23 vulnerabilities reported by Claroty Team82 to CISA, was highlighted in an advisory earlier this year. Once accessed, the controllers, which operate as small Linux computers, can be used for extended periods without detection due to their stable IP addresses and lack of monitoring.

The broader implications of these vulnerabilities have been observed in a series of attacks on European refrigeration systems. In October, hundreds of supermarkets in France had to dispose of spoiled stock after attackers manipulated refrigeration settings. Similar incidents were reported in Belgium, Luxembourg, Sweden, Finland, Ireland, Estonia, and the Netherlands. More recently, the French Blood Establishment confirmed that temperature spikes in its blood banks' cold rooms were linked to a compromised refrigeration equipment provider.

Ransom-ISAC has also reported on an attack involving an XWEB Pro controller at a commercial refrigeration site, where attackers used default credentials to alter settings. This incident coincided with the attacks on the EFS blood banks. Although pro-Russian groups claimed responsibility for some attacks, no definitive links have been established between these groups and the incidents.

SecurityScorecard has not directly connected its findings to these earlier attacks, but the potential for physical damage caused by manipulating control functions without malware or ransom demands is concerning. Thousands of such controllers remain exposed on the internet, with many lacking necessary security updates.