AI-generated · no human review · verify critical claims against the linked source.how it works →
Shahid Kaveh
actor
· actor:shahid-kaveh
Iranian cyber-offensive unit affiliated with the electronic and cyber centre (CGRI-CEC) of the Islamic Revolutionary Guard Corps, named by France's foreign ministry and the C4 crisis cell (CERT-FR CERTFR-2026-CTI-009, 2026-11-09) as the executor of the 11 to 12 October 2026 sabotage of refrigeration controllers at French retail sites; CERT-FR says it is known mainly through hacktivist personas including CyberAveng3rs and the CyberbanNews outlet, has held scripts since at least June 2024 to scan and control Schneider Electric, Siemens and Rockwell industrial equipment, and was seen in April 2026 mass-scanning Schneider Electric systems over Modbus on TCP port 502.
Aliases: Shahid Kaveh unit, CGRI-CEC Shahid Kaveh
Coverage
1
first 2026-10-13 → last 2026-11-10
Latest activity
2026-11-10
France blames Iran's IRGC for the October refrigeration attacks; Swiss cases (Köniz, Volg) are not attributed
Do-now tasks recorded on the entries about Shahid Kaveh, newest first. Check the date before acting on an older one.
Find every Danfoss AK-SM and AK-SC, Copeland xweb and Dixell xweb refrigeration controller, and any other refrigeration controller with a remote management interface because not every second-wave site's vendor is confirmed, in facilities you own or that a contractor manages for you and take its management interface off the internet now, restoring access only through a secure VPN or protected network (filtering to the contractor's source addresses is an emergency stop-gap, and CERT-FR asks you to check your insurance conditions before cutting the contractor's data uplink); an end-of-life unit that gets no fixes needs replacing, because a factory reset leaves it vulnerable and probably compromised again.
On every such controller that was reachable from the internet, check the whole configuration, defrost ranges, alarm thresholds and notification recipients included, against the intended one, verify the actual temperatures and test that alarms reach staff; for a Danfoss unit that may have been taken over, restart it or otherwise factory-reset it, restore access only through a secure VPN or protected network and reconfigure it for service, then update its firmware, set the security level to Strict and replace the default and any weak passwords, and on every Copeland or Dixell XWEB unit confirm the factory Admin password was changed and give each contractor a named account with an expiry date.
France's foreign ministry and the C4 crisis cell attribute the 11 to 12 October 2026 campaign to Shahid Kaveh (2026-11-09); the French documents do not cover the later waves
5 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.1 · compare on the matrix · Navigator layer (JSON)
ReconnaissanceActive Scanning: Scanning IP Blocks · Search Open Technical Databases: Scan Databases
Adversaries may scan victim IP blocks to gather information that can be used during targeting. Public IP addresses may be allocated to organizations by block, or a range of sequential addresses.
T1596.005Search Open Technical Databases: Scan Databases×1
Adversaries may search within public scan databases for information about victims that can be used during targeting. Various online services continuously publish the results of Internet scans/surveys, often harvesting information such as active IP addresses, hostnames, open ports, certificates, and even server banners.
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as Windows Remote Management and VNC can also be used externally.
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as Windows Remote Management and VNC can also be used externally.
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Coopérative U, Intermarché and E. Leclerc confirmed to AFP a cyberattack on their refrigeration systems overnight on 11 to 12 October 2026, at hundreds of stores (AFP, 2026-10-12). CERT-FR knows of numerous compromises of Danfoss AK-SM and AK-SC controllers and of Copeland xweb and Dixell xweb, and says exposing a management interface to the internet is contrary to good practice (CERT-FR, 2026-10-16); NCSC Switzerland rates the activity actively exploited (NCSC Switzerland, 2026-10-13). ANSSI's director general told the French Senate on 2026-10-21 that elementary flaws were exploited, above all equipment directly on the internet without particular protection, plus weak passwords (Public Sénat, 2026-10-21). On 2026-11-09 France's foreign ministry attributed the 11 to 12 October campaign to the Iranian unit Shahid Kaveh, affiliated with the Revolutionary Guard's electronic and cyber centre (French Ministry for Europe and Foreign Affairs, 2026-11-09), and CERT-FR's report words this as a bundle of indicators (CERT-FR, 2026-11-09); it covers the French campaign only, and Sekoia says the evidence suggests the October and November waves may share an actor (Sekoia, 2026-11-10).
On 2026-11-02 retailers in Belgium, Luxembourg, the Netherlands, Sweden, Ireland, Estonia and, per The Guardian, Finland reported refrigeration failures, and BleepingComputer counts more than 115 affected stores (BleepingComputer, 2026-11-02; The Guardian, 2026-11-02). The first German cases followed, and the BSI knows of cases at individual supermarkets (heise, 2026-11-03; heise, 2026-11-04). SRF reported on 2026-11-05 the first publicly known Swiss cases, at a butcher in Köniz and at three Volg stores (SRF, 2026-11-05).
A separate incident reached healthcare cold storage. The French blood service EFS confirmed that on 2026-11-02 a refrigeration-equipment supplier suffered a cybersecurity incident that affected the supervision and control installations of cold rooms at three EFS sites and raised their temperature and defrost thresholds to very high values (translated from French) (EFS, 2026-11-03). BleepingComputer, heise and SRF name the supplier as Coolworld, SRF adding that the attackers reportedly entered through its remote maintenance; Coolworld says the incident involved remote monitoring software and that the vulnerability reported in the media is in a component from a third-party supplier outside its control (BleepingComputer, 2026-11-04; heise, 2026-11-04; SRF, 2026-11-04; Coolworld, 2026-11-04). None of these sources names Danfoss, Copeland or Dixell equipment for the blood-service case.
ENISA, the European Commission, Europol and the EU CSIRTs Network advise organisations to take immediate action to mitigate exposure after the new wave of 1 to 2 November (ENISA, 2026-11-04); CSIRT Italia asks cold-chain operators in any sector to remove direct internet exposure of control interfaces and verify alarms (CSIRT Italia, 2026-11-04).
Triage: a defrost cycle is normal; BFMTV reports that installations can be programmed for two hours of defrost per 24 hours, whereas the reported attack is a continuous forced defrost at a 50-degree setpoint (translated from French) (BFMTV, 2026-10-12).
CERT-FR is aware of numerous compromises of the remote refrigeration-installation controllers Danfoss AK-SM and AK-SC series as well as Copeland xweb and Dixell xweb. (translated from French)
In an emergency, simply filtering the source IPs of the refrigeration contractors on a firewall is possible, but this solution must not be considered lasting. (translated from French)
the persistence of a compromised instance will be removed but the equipment will remain vulnerable and will certainly be compromised again. (translated from French)
the hackers would have hijacked this function by imposing a forced and continuous defrost, with a temperature setpoint fixed at 50 degrees (translated from French)
Affected stores include those operating vulnerable Danfoss consoles with remote-control capabilities that lacked an adequately secured communication channel.
While Danfoss has not confirmed the exact initial access vector, it says most affected controllers were either older models that no longer received security updates or newer models running outdated firmware.
We acknowledge the existence of the vulnerability identified on a generation of XWEB EVO controllers that is no longer marketed and has reached end of life. (translated from French)
Immediately remove all XWEB EVO units from the public internet, then look for any suspicious activity from the local network and restore the devices if necessary. (translated from French)
it is elementary security flaws that were exploited, starting with the direct exposure of refrigeration equipment on the internet and its administration without particular protection, weak passwords, that kind of thing (translated from French)
The Pentagon is treating the spate of mysterious freezer malfunctions that spoiled food at military bases across the United States in August as a suspected hack, according to four officials familiar with the matter.
Reuters could not establish whether Danfoss or any other brand of freezer controller were in use at the affected US bases.
U.S. officials suspect Iran-linked hackers are behind a series of cyberattacks that have targeted freezers at military bases around the country and caused them to malfunction, according to two people familiar with the matter.
Danfoss, the company that supplied the software for the refrigeration systems affected in both the latest incident and the one in France in October, said customers who had not updated their software were affected.
In Switzerland, too, corresponding attempts were registered at Coop - but without success, a spokeswoman for the retailer confirmed on request. (translated from German)
There is zero operational consequence, because the situation was spotted. (translated from French)
Le Canard enchaîné (quoting the French Health Ministry)
On 2 November 2026, a refrigeration-equipment supplier of the Établissement français du sang (EFS) suffered a cybersecurity incident. The supervision and control installations of cold rooms deployed at three EFS sites were affected. (translated from French)
No health impact has been identified and no loss of blood products is to be reported. (translated from French)
Établissement français du sang
Following a new wave of incidents having occurred on 1-2 November, ENISA, the European Commission (DG CNECT), Europol’s European Cybercrime Centre (EC3), the Network of the EU national computer security incident response teams (EU CSIRTs Network) and the European cyber crisis liaison organisation Network (EU- CyCLONe), advise organisations to take immediate action to mitigate exposure in the affected systems.
In total, one reportable notification about a cyberattack on commercial refrigeration systems has been received so far. (translated from German)
Keystone-SDA via swissinfo.ch
The actors may exploit vulnerabilities or weaknesses in unpatched or internet-accessible controllers to remotely alter settings and force units into continuous heating and defrost cycles
Do not expose control system devices and/or systems, particularly controller panels, to the internet
CISA, FBI, HHS, USDA and DOT
The public information reviewed does not establish a common attack method across these incidents or confirm exploitation of the specific Danfoss CVEs listed above.
NCSC Switzerland
In total, the log records 743 parameter writes affecting 31 devices.
France is able to attribute to Iran these destructive actions, carried out by the cyber-offensive unit SHAHID KAVEH, affiliated with the electronic and cyber centre of the Islamic Revolutionary Guard Corps of Iran. (translated from French)
French Ministry for Europe and Foreign Affairs
Available evidence shows similarities in the timing, the infrastructure, the targeting and observed tradecraft across the October and November waves
CERT-FR revised its alert on 2026-10-13: the list of compromised remote controllers now includes Copeland xweb and Dixell xweb besides Danfoss AK-SM and AK-SC, campaigns against these devices are probably still ongoing, and an unpatched end-of-life unit kept on the internet is very likely to be compromised, so a factory reset alone is insufficient (CERT-FR, 2026-10-13). NCSC Switzerland published advisory 13054 on 2026-10-13 with the exploitation status Actively Exploited. It lists the Danfoss AK-SM 800 (end of life, no longer patched), the AK-SC 355 (phased out, no longer patched) and the current AK-SM 800A series when it runs outdated firmware, says no fixes exist for the two older models and that Danfoss urges replacing them, and says the attack could affect other sectors, such as healthcare for specialized cooling equipment, so organisations should check whether affected devices are in use (NCSC Switzerland, 2026-10-13). Danfoss told Cooling Post that the AK-SM800 was declared end of life in 2021, that the AK-SC355 was phased out in 2016, and that the affected AK-SM800A systems ran outdated firmware (Cooling Post, 2026-10-12). Blick reports that Migros uses the same Danfoss refrigeration systems in a limited number of Swiss stores and sees no sign they were targeted, and that Aldi, Lidl and Coop say they are not affected (Blick, 2026-10-13); as of 2026-10-14 no source reported a Swiss victim. The advisory relays a six-step CERT-FR sequence (limit access to trusted addresses, factory reset, apply all fixes, rotate passwords and secrets, review accounts, reconfigure) and lists filtering to trusted addresses as a temporary measure (NCSC Switzerland, 2026-10-13), whereas the revised CERT-FR page puts removal of internet exposure first, accepts source-address filtering only as an emergency stop-gap and lists no secret rotation or account review (CERT-FR, 2026-10-13).
Censys, which scans for Danfoss StoreView control panels, says Danfoss has not confirmed the initial access vector and points to three AK-SM 800A flaws that Danfoss patched more than a year earlier: CVE-2025-41450 (March 2025), which Censys describes as letting an unauthenticated actor log in as an administrator with a code computed from the current calendar date, and CVE-2025-41451 and CVE-2025-41452 (August 2025), which it says let authenticated users run commands and disrupt the management interface (Censys, 2026-10-14). Censys maps the firmware by build: below 4.2 carries all three, 4.2.4 fixes only the date-based login and still carries the two later ones, and 4.3.1 or later fixes all three (Censys, 2026-10-14). Its scan counted 1,825 exposed StoreView panels in France on 2026-10-11 and 537 on 2026-10-14, a fall of 71 percent, with builds below 4.2, build 4.2.4 and builds from 4.3.1 leaving at about the same rate, which it reads as operators taking controllers off the internet rather than patching them (Censys, 2026-10-14). Outside France the count fell from 1,166 to 966, and in ten of the twelve countries with the most exposed hosts more than 60 percent of the hosts run a build below 4.3.1, led by Poland at 81 percent and Romania at 80 percent (Censys, 2026-10-14).
CERT-FR's alert now has a third version, dated 2026-10-16 and listed on the page as an update of the recommendations; the page does not show which sentences changed (CERT-FR, 2026-10-16). Its current text separates the two cases. For every unit it asks to remove the internet exposure of the affected units and of any unit on a public IP address, and to check the insurance contract conditions before cutting the data uplink to the refrigeration contractor (CERT-FR, 2026-10-16). For a unit not known to be compromised it then asks to check the whole configuration, notably the defrost ranges; for a compromised Danfoss unit it says to restart the equipment or otherwise restore it with a factory reset, and then to reconfigure it for service (CERT-FR, 2026-10-16). In both cases access returns only through a secure VPN or protected network, with source-address filtering for the contractors an emergency measure and not a lasting one, and the maker's practices apply (CERT-FR, 2026-10-16). The alert still says campaigns are probably ongoing, still names no flaw or entry vector, and gives the risk as not specified by the vendor (CERT-FR, 2026-10-16).
The alert's documentation section links an operator guide from Dixell France (Copeland) (CERT-FR, 2026-10-16). The file at that address was replaced on 2026-10-18; its current text, described in the correction of 2026-10-19T04:06:00Z, is Copeland's bulletin of 14 October 2026 followed by Dixell France's own complement (Dixell France, 2026-10-14). That complement says XWEB PRO and EVO ship with the same factory account, Admin with the password Admin, advises keeping the original Admin password sealed or in a password manager and not using it daily, gives each user a named account with an expiry date for an external contractor's account, and requires remote access through an encrypted VPN, with no port forward or DMZ and no remote-control software such as AnyDesk or TeamViewer on a site PC that stays on (Dixell France, 2026-10-14). CERT-FR does not say how the attackers got in, and SecurityWeek writes that neither Danfoss nor French authorities have tied the attack to the flaws Claroty disclosed (CERT-FR, 2026-10-16; SecurityWeek, 2026-10-15).
The Dixell France guide that CERT-FR links was replaced on 2026-10-18, the file's date on the vendor's server, and now opens with Copeland's own security bulletin dated 14 October 2026 (Dixell France, 2026-10-14). The earlier update section's statements about XWEB PRO firmware 1.12.1, a CISA advisory and a March 2024 bulletin are no longer on that page and are removed from the summary and the body. The bulletin acknowledges the vulnerability on a generation of XWEB EVO controllers that is no longer marketed and has reached end of life, says to remove every XWEB EVO from the public internet immediately and then look for suspicious activity from the local network, and says XWEB EVO no longer receives security patches, while XWEB PRO is the supported platform and must not be exposed to the internet either (Dixell France, 2026-10-14). For an XWEB EVO that may have been accessed it gives a procedure: isolate the unit, restore the latest backup made before the access or otherwise check the users and profiles, set new passwords, check the alarm categories and recipients with a test alarm, and restore the device parameters from backup files or, without one, read each device's parameters and check setpoints, alarm thresholds and defrost parameters; it also says to check the product temperatures in the cabinets directly, since altered setpoints or alarm thresholds can compromise food safety (Dixell France, 2026-10-14).
Le Monde reports that besides raising the defrost temperature to 50 degrees the attackers lengthened the defrost operation from one hour to eight so that alarms trigger late, which delayed interventions and amplified the damage (translated from French) (Le Monde, 2026-10-12). SecurityWeek relays that detail and adds that the Paris prosecutor's office said the attack caused fires as well as food losses, that the Finance Minister put the number of affected supermarkets at about 700 of roughly 10,000, and that investigators are reportedly puzzled by the lack of a claim of responsibility or a ransom demand, citing Reuters (SecurityWeek, 2026-10-15). Cybersecurity Dive had already reported that a Copeland spokesperson confirmed the vulnerability was found in discontinued end-of-life controllers (Cybersecurity Dive, 2026-10-15).
ANSSI's director general, Vincent Strubel, told the French Senate foreign-affairs committee on 2026-10-21 that the attack rested on elementary security flaws, starting with refrigeration equipment directly on the internet and administered without particular protection, and weak passwords, and he dismissed analyses that tied it to vulnerabilities researchers had published over the previous two years (Public Sénat, 2026-10-21). Le Monde Informatique reports the same hearing and adds that the systems were reachable without a firewall or network segmentation and that the management interface was protected only by weak passwords (Le Monde Informatique, 2026-10-22). Neither outlet reports evidence beyond the testimony, and ANSSI names no actor; the account sits against Copeland's acknowledgment of a vulnerability in its end-of-life XWEB EVO controllers and the earlier report that ANSSI had identified a vulnerability in a Danish company's software, and no source reconciles them; the two outlets also differ on the date and the count, Public Sénat giving the night of 12 to 13 October and more than 700 supermarkets, Le Monde Informatique the night of 11 to 12 October and at least 300 Intermarché and Netto shops. Le Monde Informatique adds that ANSSI can alert and advise but has no means to impose connection rules on retailers (Le Monde Informatique, 2026-10-22), and Public Sénat reports that ANSSI ran a rapid check with health-sector players because laboratories and pharmacies that store vaccines use the same kind of refrigeration equipment (Public Sénat, 2026-10-21).
Forescout's Vedere Labs says on 2026-10-22 that the access vector, exploited vulnerabilities, attacker infrastructure, persistence and responsible actors in the French incidents remain unconfirmed, and that the reported changes, made in rapid succession, used ordinary supervisory functions (Forescout, 2026-10-22). Its tracking of hacktivist groups counts over 20 claimed attacks on refrigeration systems since January 2026, the most active being the pro-Russian groups Z-Pentest Alliance and NoName057(16) through internet-exposed human-machine interfaces, and its count of exposed services is 12,976 observations on 6,017 public addresses in 99 countries, with 3,762 exposed Danfoss StoreView observations on AK-SM 800A units, 80 percent of the 4,697 StoreView observations, on firmware older than 4.3.1 (Forescout, 2026-10-22). Forescout adds that the manufacturers' documentation presents internet remote maintenance through port forwarding as a supported option, so the exposure is not only an accident of configuration (Forescout, 2026-10-22).
Reuters reported on 2026-10-29, citing four officials, that the Pentagon is treating the late-August freezer failures at military bases across the United States as a suspected hack (Reuters, 2026-10-29). On Reuters' own review of the bases' social-media posts at least six commissaries were hit, and in at least one case the cooling units' temperatures were raised overnight instead of the units stopping; Fort Huachuca said its freezer "went into defrost mode where it heated up all the food" (Reuters, 2026-10-29). A Cyber Command unit and the Army Criminal Investigation Division's Cyber Field Office are involved, and one official said the investigators are in touch with their French counterparts about the French attack; Reuters could not establish whether Danfoss or any other controller brand was in use at the bases, nor how far the investigation had got or who might be responsible (Reuters, 2026-10-29).
Nextgov reported on 2026-10-30, citing two people familiar with the matter, that US officials suspect Iran-linked hackers, that the intrusions began around late August, that how the intruders got in is not clear and that the assessment may change (Nextgov, 2026-10-30). No official has attributed the activity on the record, and the sources give no technical evidence for the suspicion. The only stated link between the two cases is the investigators' contact, and Reuters notes that the French attack, like the Fort Huachuca failure, raised temperatures instead of switching units off (Reuters, 2026-10-29).
On 2026-11-02 refrigeration failures struck stores in Belgium, Luxembourg, the Netherlands, Sweden, Ireland and Estonia, and Finland according to The Guardian; BleepingComputer counts more than 115 affected stores from company statements and says it is unclear whether they were hit in a coordinated attack, and several companies confirmed they had been hacked (BleepingComputer, 2026-11-02; The Guardian, 2026-11-02). Sabcobel's chief executive says the units' evaporators were switched to defrost mode (The Guardian, 2026-11-02) and, per BleepingComputer, that the attacker used the same vulnerability as in France (BleepingComputer, 2026-11-02); Euronews names Danfoss as the software supplier in both incidents and quotes it saying customers who had not updated their software were affected (Euronews, 2026-11-02), and in Estonia attackers reached the control computer of an older Danfoss system with outdated software (translated from German) (Tagesschau, 2026-11-02). CyberInsider nonetheless states that the manufacturer, controller models and initial access method of the new wave remain unknown (CyberInsider, 2026-11-02), so the vendor of the Belgian and Swedish sites is not independently confirmed. Coop Switzerland told 20 Minuten that corresponding attempts were registered without success, and Migros reports no indication of an attack (20 Minuten, 2026-11-02). The head of Sweden's national cybersecurity centre says it is working on incidents around the country and that Sweden has quite a lot of exposed operational technology devices (The Guardian, 2026-11-02).
The first German cases followed on 2026-11-02: heise reports that the cooling systems of an Edeka market in Reisbach, Lower Bavaria, were heated to 50 degrees overnight into Monday and that the police have not confirmed a cyberattack as the cause, and WDR quotes a division manager at a CAP supermarket in North Rhine-Westphalia saying the actual attack hit the firm that maintains the cooling plants remotely, which is the operator's statement and not an authority finding, and Rewe's head office confirmed to WDR a cyberattack aimed specifically at the cooling-system supplier Danfoss, whose technology only a few regional Rewe stores use (translated from German) (heise, 2026-11-03; WDR, 2026-11-03). SentinelLABS' assessment of 2026-11-03 says responsibility for the European incidents has not been publicly established, calls Russian-aligned disruptive groups one credible hypothesis based on precedent, and says shared maintenance access deserves scrutiny (SentinelLABS, 2026-11-03). Le Canard enchaîné reports that Coolworld, a company that maintains refrigerated storage containers for the French blood service, was hacked overnight on 1 to 2 November and that cold rooms held at minus 30 degrees were programmed to reach 110 degrees; the blood service says an on-duty technician saw the temperature rise and acknowledges that frozen plasma intended for transfusion was among the products, and the Health Ministry says there was zero operational consequence because the situation was spotted (translated from French) (Le Canard enchaîné, 2026-11-03). The 110 degrees is the programmed set-point and not a measured temperature, and no source names the equipment, the vendor or the access method, or ties this case to the Danfoss and Copeland controllers.
The French blood service EFS confirmed on 2026-11-03 that on 2 November a refrigeration-equipment supplier suffered a cybersecurity incident that affected the supervision and control installations of cold rooms at three EFS sites, with temperature and defrost thresholds raised to very high values (translated from French) (EFS, 2026-11-03). EFS says its own monitoring and alarm systems identified the anomalies quickly, the affected equipment was brought under control without impact on the products or neutralised, the products stored in those cold rooms were transferred preventively to other installations, and no health impact or loss of blood products is to be reported; it names no supplier and gives no temperature figure (translated from French) (EFS, 2026-11-03).
BleepingComputer, heise and SRF identify the supplier as Coolworld, and SRF reports that the attackers reportedly entered through its remote maintenance (BleepingComputer, 2026-11-04; heise, 2026-11-04; SRF, 2026-11-04). Coolworld's statement of 2026-11-04 says the incident involved remote monitoring software, that the vulnerability reported in the media relates to a component from a third-party supplier outside its control and that a limited number of its units were affected; it does not say that attackers exploited that component (Coolworld, 2026-11-04). BleepingComputer's account reads it the other way, saying Coolworld says the attackers exploited a vulnerability in a third-party component, which the statement does not state (BleepingComputer, 2026-11-04). No source names Danfoss, Copeland or Dixell equipment for this case.
ENISA, the European Commission (DG CNECT), Europol's EC3, the EU CSIRTs Network and EU-CyCLONe issued a joint statement on 2026-11-04: since 11 October 2026 several commercial refrigeration systems and similar devices have been hit in a number of EU Member States, a new wave occurred on 1 to 2 November, affected Member States are investigating and issuing guidance, and organisations are advised to take immediate action to mitigate exposure in the affected systems; it names no product, actor or count and does not mention Switzerland (ENISA, 2026-11-04). CSIRT Italia's bulletin of 2026-11-04 extends its call to every operator of cold-chain technology, whatever the sector, to apply its earlier measures urgently, removing direct internet exposure of administrative and control interfaces and verifying that operating parameters and alarms are intact first (CSIRT Italia, 2026-11-04). Its bulletin of 2026-10-13, re-issued on 2026-11-04 as version 1.2, asks operators to limit supplier access to authorised resources and periods, to require multi-factor authentication on remote access, applied on the mediating system when the device cannot do it, and to check actual temperatures and alarms with instruments independent of the supervision platform (CSIRT Italia, 2026-11-04). The BSI had urged operators of networked freezer controllers to disconnect them from the internet or at least secure and patch them (heise, 2026-11-04).
SRF reported on 2026-11-05 the first publicly known attack of this kind in Switzerland: the butcher Lüthis Fleischwaren in Köniz, canton Bern, told customers that manipulation of the electronic control of its cooling and freezer systems caused considerable temperature deviations, the owner told SRF he found 50 to 70 degrees in the freezer, and the firm disconnected the installation from the network and closed the branch (translated from German) (SRF, 2026-11-05). Keystone-SDA adds that the shop can probably only reopen on 20 November and that the Bern cantonal police were briefly informed on Monday and had received no complaint yet (Keystone-SDA via swissinfo.ch, 2026-11-05). Volg says three of its stores noticed that parameters in the cooling shelves had been changed (SRF, 2026-11-05). No source names the controller make, the access route or a maintenance provider in the Swiss cases; Keystone-SDA notes that operators can supervise cooling plants centrally over the internet and that the butcher apparently has such an installation, which is the agency's inference and not the owner's statement (Keystone-SDA via swissinfo.ch, 2026-11-05). BACS told Keystone-SDA that it does not comment on specific incidents and has received one reportable notification about a cyberattack on commercial refrigeration so far, and it stressed that voluntary reports are welcome at any time (Keystone-SDA via swissinfo.ch, 2026-11-05). Blutspende SRK Schweiz told Keystone-SDA that no attacks on Swiss blood-donation services are known to date (SRF, 2026-11-05).
On the same day CISA, the FBI, HHS, USDA and DOT published a joint fact sheet on malicious cyber activity against industrial refrigeration and cold-chain monitoring systems worldwide: the actors may exploit vulnerabilities or weaknesses in unpatched or internet-accessible controllers to remotely alter settings and force units into continuous heating and defrost cycles, through authentication bypass, arbitrary code injection or weak configurations, with loss of visibility into current temperatures as a further effect (CISA, 2026-11-05). It names no vendor, CVE, victim or actor; its mitigations include keeping controller panels off the internet, allowlisting the devices and IP addresses that may change settings, defining reasonable setpoint limits for downstream devices with alerting on deviations, and collecting network traffic between OT assets where logs are not available (CISA, 2026-11-05).
NCSC Switzerland edited its advisory on 2026-11-06 with the reason "added Swiss incidents, Copeland/Dixell XWEB and healthcare attacks" and states that "The public information reviewed does not establish a common attack method across these incidents or confirm exploitation of the specific Danfoss CVEs listed above"; it lists CVE-2025-41451, CVE-2025-41450 and CVE-2025-41452 as "alleged as potentially related" (NCSC Switzerland, 2026-10-13). Its checklist asks operators to review refrigeration management systems across all relevant operations, "including equipment managed by external service providers"; to remove direct internet access to management interfaces and provide remote access through a secure VPN; to check temperature settings, defrost schedules, alarm thresholds, notification recipients and user accounts, verify actual temperatures and test alarm delivery; and to apply current firmware and plan to replace equipment that no longer gets security updates (NCSC Switzerland, 2026-10-13). For a suspected compromise it says "A factory reset alone is insufficient if the system remains vulnerable and directly accessible from the internet" (NCSC Switzerland, 2026-10-13).
Ransom-ISAC published the event log of a Copeland XWEB Pro controller, reportedly on firmware 1.9.0 and reachable through a public address, compromised on 2 November: two Administrator sessions from different external addresses read parameters across 31 devices, then made 588 writes across 26 devices in about six minutes, which Ransom-ISAC reads as scripted or bulk programming rather than manual edits, and 155 further writes across five cold rooms, moving setpoints to 110 and 150 degrees C and recording keypad-lock, alarm-mute and defrost commands (Ransom-ISAC, 2026-11-06). The post says the controller still used its default Administrator credentials, publishes no evidence for that statement, says the log cannot show how the attackers got in or what temperatures were reached, and says it has no evidence linking the case to NoName057(16), Z-Pentest Alliance or the French attacks (Ransom-ISAC, 2026-11-06). Its suggested alerts are more than about 20 parameter-write events a minute from one account, writes to more than three devices within five minutes, and keypad-lock, alarm-mute or defrost commands that do not come from the scheduler (Ransom-ISAC, 2026-11-06).
Unit 42 counts over 5,000 internet-exposed devices across countries from the manufacturers CERT-FR names on 5 and 6 November, and for France alone 1,853 in the first half of October, 558 in the second half and 316 in the first six days of November, and says the claims of NoName057(16) and Z-Pentest Alliance remain unverified (Unit 42, 2026-11-06). The counts do not show which versions are vulnerable.
France's foreign ministry said on 2026-11-09 that, following the investigation, France is able to attribute the destructive actions of the night of 11 to 12 October to Iran, carried out by the cyber-offensive unit Shahid Kaveh, affiliated with the electronic and cyber centre of the Islamic Revolutionary Guard Corps, and calls it the first cyber-offensive campaign run purely for sabotage on French soil (translated from French) (French Ministry for Europe and Foreign Affairs, 2026-11-09). The report of the C4 crisis cell, which CERT-FR published, words the case as a bundle of indicators that names the Revolutionary Guard as sponsor and Shahid Kaveh as executing unit (translated from French) (CERT-FR, 2026-11-09). The indicators it lists are attack infrastructure also used in the same period to reconnoitre Schneider Electric equipment, use of the FOFA scan tool, which it says the unit habitually uses, relay of the attack on the unit's CyberbanNews outlet from 13 October, and traces of Farsi in the attack infrastructure (CERT-FR, 2026-11-09).
The same report says the unit is known mainly through hacktivist personas, CyberAveng3rs among them, and the CyberbanNews outlet, and that it has held scripts since at least June 2024 to scan, access and control Schneider Electric, Siemens and Rockwell industrial equipment; in April 2026 it was seen using Modbus on TCP port 502 for mass reconnaissance of Schneider Electric systems, including in France (CERT-FR, 2026-11-09). The C4 links to the same attack the concurrent targeting of Schneider Electric equipment at small hydroelectric installations in France, with moderate effects on the targeted equipment (CERT-FR, 2026-11-09). Industrial controllers of that class, reachable on Modbus, belong in the same internet-exposure check as the refrigeration controllers.
The attribution covers the French campaign of 11 to 12 October. Sekoia's honeypots recorded unauthenticated requests to the controllers' xml.cgi endpoint from 26 addresses, password spraying of the Supervisor and admin accounts and, on 2026-11-01, an attempt to use a non-public flaw that renames an account by its numerical identifier; Sekoia says the evidence shows similarities between the October and November waves that suggest they may share an actor, and that it assesses the NoName057(16) and Z-Pentest Alliance claim with doubts (Sekoia, 2026-11-10). Reuters reports that the Paris prosecutor's office said it had requested international arrest warrants against the leader of Shahid Kaveh and his two deputies, and that it could not establish exactly how the French made their determination (Reuters via NBC News, 2026-11-09). NCSC Switzerland's advisory still says the public information does not establish a common attack method across the incidents (NCSC Switzerland, 2026-10-13).