US agencies warn attackers are targeting refrigeration systems that protect food and medicine
Threat actors are going after the controllers that keep grocery store freezers and cold storage rooms at safe temperatures, and they may push those units into continuous heating and defrost cycles, five US federal agencies warned in a joint advisory published on Thursday.
Threat actors are going after the controllers that keep grocery store freezers and cold storage rooms at safe temperatures, and they may push those units into continuous heating and defrost cycles, five US federal agencies warned in a joint advisory published on Thursday.
CISA, the FBI, the Department of Health and Human Services (HHS), the US Department of Agriculture (USDA) and the Department of Transportation (DOT) issued the warning in response to ongoing malicious activity aimed at industrial refrigeration and cold chain monitoring systems globally.
Organizations in healthcare and public health, chemical, food and agriculture, and transportation rely on these systems, refrigerated transport included, to monitor and log temperatures, manage defrost cycles and keep energy use in check.
According to the agencies, hackers target electronic temperature controllers and commercial refrigeration controllers in retail grocery and cold storage facilities, and may exploit weaknesses in controllers that are unpatched or reachable from the internet.
Where remote access can’t be avoided, it should go through a firewall or edge device that is kept updated to its latest version; since October, Help Net Security has reported on a series of attacks on refrigeration systems in Europe.
Brett Leatherman, operations director of the FBI’s Cyber Branch, said the bureau is seeing these systems targeted in several infrastructure sectors around the world, with inventory and equipment put at risk.
The agencies want owners and operators to act immediately, and the first item on their list is to stop exposing controller panels and other control system devices to the internet.
Once an attacker gets in, the temperature settings can be changed remotely, and a unit forced into heating the agencies wrote.
There is a serious public health angle, since food or medicine kept in bad conditions could Staff could also lose sight of what is happening inside the units, a situation the agencies call a denial-of-view condition, in which current temperatures can’t be seen.
Possible routes in include authentication bypass and arbitrary code injection, along with weak configurations.
Operators are also told to put operational technology devices on a dedicated VLAN separate from business networks, change default passwords, and turn on phishing-resistant multifactor authentication where feasible.
The further recommendations include limiting who can make changes through device and IP address allowlisting, keeping tested offline backups, and enabling logging.
Firmware should be kept up to date, and devices the vendor no longer supports should be retired and replaced.
What happened
Threat actors are going after the controllers that keep grocery store freezers and cold storage rooms at safe temperatures, and they may push those units into continuous heating and defrost cycles, five US federal agencies warned in a joint advisory published on Thursday.
CISA, the FBI, the Department of Health and Human Services (HHS), the US Department of Agriculture (USDA) and the Department of Transportation (DOT) issued the warning in response to ongoing malicious activity aimed at industrial refrigeration and cold chain monitoring systems globally.
Organizations in healthcare and public health, chemical, food and agriculture, and transportation rely on these systems, refrigerated transport included, to monitor and log temperatures, manage defrost cycles and keep energy use in check.
What changed
According to the agencies, hackers target electronic temperature controllers and commercial refrigeration controllers in retail grocery and cold storage facilities, and may exploit weaknesses in controllers that are unpatched or reachable from the internet.
Where remote access can’t be avoided, it should go through a firewall or edge device that is kept updated to its latest version; since October, Help Net Security has reported on a series of attacks on refrigeration systems in Europe.
Who is affected
Brett Leatherman, operations director of the FBI’s Cyber Branch, said the bureau is seeing these systems targeted in several infrastructure sectors around the world, with inventory and equipment put at risk.
The agencies want owners and operators to act immediately, and the first item on their list is to stop exposing controller panels and other control system devices to the internet.
Why it matters
Once an attacker gets in, the temperature settings can be changed remotely, and a unit forced into heating the agencies wrote.
There is a serious public health angle, since food or medicine kept in bad conditions could Staff could also lose sight of what is happening inside the units, a situation the agencies call a denial-of-view condition, in which current temperatures can’t be seen.
Technical details
Possible routes in include authentication bypass and arbitrary code injection, along with weak configurations.
Operators are also told to put operational technology devices on a dedicated VLAN separate from business networks, change default passwords, and turn on phishing-resistant multifactor authentication where feasible.
Response
The further recommendations include limiting who can make changes through device and IP address allowlisting, keeping tested offline backups, and enabling logging.
What security teams should do
Firmware should be kept up to date, and devices the vendor no longer supports should be retired and replaced.
Attribution
Help Net Security: Threat actors are going after the controllers that keep grocery store freezers and cold storage rooms at safe temperatures, and they may push those units into continuous heating and defrost cycles, five US federal agencies warned in a joint advisory published on Thursday.
What to watch next
Watch for revised vendor guidance, fixed versions and mitigation updates.