TL;DR
Get backup power and energy gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Glasgow-based cybersecurity company Lupovis reported more than 276 attempts to identify or authenticate against Danfoss AK-SM refrigeration controllers during a 10-day period beginning October 20. The activity peaked on October 26 and stopped by the end of the month; the report does not establish that those attempts succeeded or caused the later attacks. Forescout separately reported claimed attacks on refrigeration systems and thousands of internet-exposed services.
Cybersecurity company Lupovis detected more than 276 attempts targeting Danfoss AK-SM refrigeration controllers over a 10-day period beginning October 20, in activity that preceded a reported spate of cyberattacks. The Glasgow-based company said the attempts came from 91 different threat actors; its findings show probing and authentication attempts, but do not establish that the controllers were compromised or that the activity caused the later attacks.
Lupovis said it detected reconnaissance targeting the controllers from October 20 through the end of the month. Activity peaked on October 26 before stopping by the end of the month. The company counted more than 276 attempts matching specific components of Danfoss controllers, attributed to 91 threat actors.
According to Lupovis, most of the adversaries tried to authenticate with publicly documented factory-default usernames and passwords. The report does not say how many attempts reached a controller, whether any login succeeded, or whether any refrigeration operation was disrupted.
The disclosure follows separate research from Forescout Technologies. The company said it had tracked and identified more than 20 claimed attacks against refrigeration systems since January. Forescout also reported 12,976 internet-exposed service observations across 10 product groups, linked to 6,017 distinct public IP addresses in 99 countries and territories.
Exposure Across Refrigeration Networks
Refrigeration controllers manage equipment used to maintain temperature in settings such as commercial and industrial facilities. Attempts to access those systems matter because a successful compromise could pose operational risks, although the Lupovis findings do not report any successful access or resulting damage.
The observations reported by Forescout point to a broad internet-facing footprint across several product lines. They are service observations, not a count of confirmed breaches; their presence online does not prove that systems were vulnerable or exploited. Together, the reports underscore the need for operators to know which controllers are reachable from the internet and to avoid leaving factory-default credentials in place.
Products Worth Considering
Samsung 43-Inch M70H Series 4K Mini LED Smart TV (2026)
Roborock RockMow X130H Wire-Free 4WD Robot Lawn Mower
Blueair Blue Pure 311i Max Air Purifier
As an affiliate, we earn on qualifying purchases.
Two Reports, Different Findings
The reports describe related security concerns but measure different activity. Lupovis tracked attempts associated with Danfoss AK-SM controllers during a specific 10-day period in October. Forescout’s account covers claimed attacks against refrigeration systems dating from January, along with exposed service observations spanning 10 product groups.
Forescout identified 7,075 Copeland/Dixell XWEB services, 4,697 Danfoss StoreView services, 551 Copeland Site Supervisor services, 513 Carel pCOWeb services and 140 other services across six product groups. These figures describe the observed services, not confirmed compromised devices. Forescout also named Z-Pentest Alliance and NoName057(16) as the most active groups behind the attacks it tracked, describing both as pro-Russian.
“The company detected over 276 attempts coming from 91 different threat actors matching specific components of Danfoss controllers during this 10-day period.”
— Lupovis, as reported by Cooling Post
No Confirmed Controller Breaches
The published account does not establish whether any of the 276-plus attempts succeeded, which specific facilities or operators were targeted, or whether the October reconnaissance was connected to the later attacks. It also does not provide technical details about the methods used beyond the reported attempts to match controller components and try default credentials.
Forescout’s total of more than 20 is described as claimed attacks, while its 12,976 figure counts internet-exposed service observations. The source does not give a verified victim count or show that every observed service was exploitable. The identity and location of affected operators, and any confirmed service impact, remain unclear.
Operators Should Check Remote Access
The report does not announce a formal investigation, response deadline or next publication from either company. For refrigeration operators, the immediate practical steps are to review whether controllers are exposed to the public internet, replace factory-default credentials, and restrict remote access to authorized users and networks. Operators should also monitor device logs and follow security guidance from their equipment suppliers.
Further reporting would be needed to establish whether any authentication attempt led to access, whether the October activity was tied to the subsequent attacks, and whether any refrigeration services were disrupted. Until those details are available, the findings indicate attempted targeting and exposure—not confirmed compromise.
Key Questions
What did Lupovis detect?
Lupovis reported more than 276 attempts matching components of Danfoss AK-SM refrigeration controllers during a 10-day period beginning October 20. It attributed the attempts to 91 threat actors.
Were any refrigeration controllers confirmed compromised?
The source does not report a confirmed compromise. It describes reconnaissance and authentication attempts, without saying whether any login succeeded or any equipment was disrupted.
What credentials were attackers trying?
Lupovis said most adversaries tried publicly documented factory-default usernames and passwords. The report does not state whether those attempts gained access.
What did Forescout report?
Forescout said it had tracked more than 20 claimed attacks against refrigeration systems since January and observed 12,976 internet-exposed services across 10 product groups. The observations are not a count of confirmed breaches.
Is the October activity linked to the later attacks?
The available report does not establish a connection. It says the Lupovis activity preceded a reported spate of attacks, but provides no evidence confirming that the same actors or campaign were involved.
Source: coolingpost.com
