The Cold Chain on Fire: Unpatched Danfoss controllers exploited

Between October and November 2026, cyberattacks targeted unpatched Danfoss refrigeration controllers exposed to the internet in hundreds of supermarkets across France and over a dozen European countries. Attackers exploited outdated firmware vulnerabilities, including authentication bypass flaws, to modify temperature settings and defrost cycles, causing significant food spoilage valued at tens of millions of euros. The attacks were attributed to Iran's Islamic Revolutionary Guard Corps unit "Shahid Kaveh," linked to the CyberAveng3rs group. These incidents highlight the risks of exposed industrial control systems and the accelerating role of generative AI in exploit development for ICS devices.

• Exploitation Targeting Node-RED, a Tool Embedded in ICS ProductsCampaign2026-11-03
• Ongoing PLC Exploitation Against Critical U.S. InfrastructureCampaign2026-07-24
• A Dish Served Lukewarm: The Refrigerator BotnetCampaign2026-11-06
• Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257ExploitedVulnerability2026-10-20
• Shell Data Breach 2026: Cl0p Ransomware Syndicate Leaks 89GB of Critical Energy Infrastructure DataAnalysis2026-08-17