> ## Content Index > Fetch the complete content index at: https://blog.previdian.com/llms.txt > Use this file to discover other available public pages before exploring further. # Who’s Trying to Get Into Our Fridge Freezer? There's nowt in it! - URL: https://blog.previdian.com/whos-trying-to-get-into-our-fridge-freezer-theres-nowt-in-it/ - Published: 2026-11-05T12:49:08.000Z - Updated: 2026-11-05T12:59:41.000Z - Author: Ryan Dewhurst **What Our Danfoss Decoy Recorded During the European Refrigeration Incidents** The fridge freezer hacks across Europe have attracted a lot of media attention over the past few days, including coverage of our intelligence and analysis in [The Wall Street Journal](https://www.wsj.com/tech/cybersecurity/hackers-crank-the-heat-on-europes-supermarket-freezers-to-above-120-degrees-73597a8a?ref=blog.previdian.com) and [BBC News](https://www.bbc.co.uk/news/articles/c8vgxyvz6y9ro?ref=blog.previdian.com), amongst others. We’ve been following the activity through our global honeypot network. On 27 October 2026, one of our Danfoss decoys received three attempts to log in using `Supervisor / 12345`. The same IP had stopped by two days earlier. When it came back, it checked the version and then tried the login using documented default credentials. # The Systems Behind the Headlines These attacks concern the controllers used to manage commercial refrigeration. They let operators monitor equipment, manage alarms and change settings remotely. That remote access is useful. But when the management interface is exposed directly to the internet, anyone can find it and try to get in. On 12 October 2026, France's CERT-FR [published an alert](https://www.cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-012/?ref=blog.previdian.com) about compromises of refrigeration controllers. Its updated notice names Danfoss AK-SM and AK-SC systems, alongside Copeland and Dixell XWEB systems. The alert does not identify the vulnerability or credentials used for initial access. A second wave of refrigeration incidents was [reported across Europe on 2 November](https://decipher.sc/incidents/second-wave-of-suspected-cyberattacks-hits-european-supermarket-freezers/?ref=blog.previdian.com), roughly three weeks after the French incidents. We don’t know whether the same attacker or method was involved in both. # Code of the Day In [research published on 9 August 2026](https://claroty.com/team82/research/freeze-the-controller-defrost-the-food-uncovering-vulnerabilities-in-danfoss-refrigeration-controllers?ref=blog.previdian.com), Claroty Team82 described an alternate authentication mechanism that accepts a “code of the day” derived from the controller's date. Claroty reported its findings to Danfoss through coordinated disclosure. Following Claroty’s research, we reverse engineered the Danfoss firmware to confirm how the code was calculated. Here’s the relevant logic. The year value in the firmware we analysed is two digits. ```c Get_syst_current_tds(&date); // Read the device's clock. ftext_s(buff, 511, "%02d%02d%02d%02d", date.month, date.day, date.year, date.month); // Build the string MMDDYYMM. sscanf(buff, "%lx", &hex); // Interpret it as hexadecimal. ftext_s(buff, 511, "%02d", date.day); sscanf(buff, "%lx", &tothex); // Interpret DD as hexadecimal too. hex = (hex / tothex) % 100000; ftext_s(buff, 511, "%05ld", hex); // Format the five-digit daily code. ``` The result is a five-digit decimal code, padded with leading zeroes (which are later removed). Once you know the algorithm and the date on the device (or guess it), you can work out the code without knowing the administrator’s password. Even without the algorithm, there are only 100,000 possible five-digit codes. Trying them all would be a much noisier approach. We don’t know whether this vulnerability was used to compromise the affected refrigeration systems. What we saw against our decoy was a different approach. # The Attack After the earlier incident reports, we set up a **Danfoss AK-SM 800A decoy honeypot in Finland**. We built it to resemble a real device, pixel for pixel and endpoint for endpoint, including the StoreView interface. ## First Visit on 25 October The source address `188.208.141[.]210` requested the decoy's homepage. The request included browser-like headers and a reference to [FOFA](https://en.fofa.info/?ref=blog.previdian.com), an internet asset search service. Here are the relevant headers, with the destination (our honeypot) redacted: ```http GET / HTTP/2.0 Host: [REDACTED] User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/155.0.0.0 Safari/537.36 Referer: https://en.fofa.info/ Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document ``` The `Referer` header suggests the visit started with a FOFA result, although that header can be spoofed. This would also align with attacker tactics; to create a list of targets before launching an attack. They didn’t try to log in on that first visit. Just a visit to the homepage. ## Return Visit and Version Checks on 27 October Two days later, the same IP was back, with the same browser User-Agent and FOFA Referer values. About a minute later, it requested `SVB5.ver`. The decoy returned: ```text SVB501.0.156 ``` This time, the User-Agent had changed to `python-requests`, suggesting a script was now involved. The response was the version string we had configured our decoy to return. They also tried `metadata.json`, but got a 404. ## Three Attempts Using Supervisor and 12345 Then came three login attempts, each submitting the username `Supervisor` and password `12345` to `/xml.cgi`. The requests were back to using the browser User-Agent we’d seen during the earlier visits. Here’s one of those requests: ```http POST /xml.cgi HTTP/2.0 Host: [REDACTED] User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/155.0.0.0 Safari/537.36 Accept: application/json, text/plain, */* Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br, zstd Content-Type: text/plain Content-Length: 158 Origin: https://[REDACTED] Referer: https://[REDACTED]/ Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Ch-Ua: "Google Chrome";v="155", "Chromium";v="155", "Not(A:Brand";v="24" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Priority: u=1, i xml=%3Ccmd%20user%3D%22Supervisor%22%20password%3D%2212345%22%20action%3D%22getauth%22%20storeview_only%3D%221%22%20version%3D%22C%22%20lang%3D%22eng%22%2F%3E ``` Decoding the `xml` parameter gives us: ```xml ``` The `Supervisor` username piqued our team’s interest. Up to this point, we hadn’t come across it in our investigation. Was this a generic password guess, an educated guess, or a real Danfoss account? We found the exact pair in Danfoss’s public [**AK-SM 800**](https://assets.danfoss.com/documents/latest/35543/AN227786497256en-000901.pdf?ref=blog.previdian.com#page=96)[ user guide](https://assets.danfoss.com/documents/latest/35543/AN227786497256en-000901.pdf?ref=blog.previdian.com#page=96): `Supervisor / 12345`, listed as the factory-default credentials for the web interface. That gave us a good reason to think these were deliberate attempts to access a Danfoss system. That manual covers the older AK-SM 800\. The current [**800A**](https://assets.danfoss.com/documents/latest/590332/BC337629891709en-001101.pdf?ref=blog.previdian.com#page=12)[ guide](https://assets.danfoss.com/documents/latest/590332/BC337629891709en-001101.pdf?ref=blog.previdian.com#page=12) has administrators create credentials during setup, so we shouldn’t assume every 800A will accept this pair. They submitted the same pair three times. Our decoy rejected all three attempts, so there were **no successful logins**. These requests don’t show the code-of-the-day bypass being used. We also looked for this IP across our global honeypot network. In the records reviewed for this investigation, it appeared on 25 and 27 October only. # Further Investigation On **25 October 2026**, the same day this IP first visited our decoy, a representative of a French refrigeration company posted on LinkedIn and Instagram about a reported Danfoss compromise. ![](https://storage.ghost.io/c/1c/21/1c213298-6101-4c8a-9e02-660a9e08724c/content/images/2026/11/LINKEDIN.png) According to the post, the intruder started with a bot to brute-force a customer account’s password, then reached the supervisor account and left a little souvenir by changing its name to: > HACKED BY JUDRUD The screenshot has the Danfoss **Info** tab open, with what look like log entries for a **Supervisor** login dated **23 October 2026**. That was two days before both the post and the first visit to our decoy. ![](https://storage.ghost.io/c/1c/21/1c213298-6101-4c8a-9e02-660a9e08724c/content/images/2026/11/danfoss.jpeg) That is the sequence described in the post; we haven’t independently confirmed it. And the original reporter may have mistaken a brute force attack for a simple default login. # Timeline | **Date** | **Event** | **Evidence** | | ------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------ | | 9 August 2026 | Claroty publishes [its AK-SM 800A research](https://claroty.com/team82/research/freeze-the-controller-defrost-the-food-uncovering-vulnerabilities-in-danfoss-refrigeration-controllers?ref=blog.previdian.com), including the code-of-the-day authentication mechanism. | Original research. | | 11–13 October 2026 | [French reporting](https://www.lemonde.fr/pixels/article/2026/10/13/cyberattaque-contre-les-supermarches-apres-ceux-de-l-entreprise-danfoss-d-autres-systemes-de-refrigeration-ont-ete-vises%5F6793121%5F4408996.html?ref=blog.previdian.com) describes refrigeration incidents involving Danfoss and Dixell systems. | Public incident reporting. | | 12 October 2026 | CERT-FR publishes [its refrigeration-controller incident alert](https://www.cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-012/?ref=blog.previdian.com), subsequently updated on 13 and 16 October. | Government incident warning. | | 23 October 2026 | The screenshot accompanying the JUDRUD report appears to show Supervisor login entries in the Danfoss Info tab. | Date displayed in the reported screenshot. | | 25 October 2026 | A representative of a French refrigeration company publishes the JUDRUD report, alleging an account compromise and the name change “HACKED BY JUDRUD”. | Public post; separate reported incident. | | 25 October 2026 | 188.208.141\[.\]210 visits Previdian's Finland decoy with a FOFA Referer header. No login attempt is recorded during that visit. | Previdian decoy telemetry. | | 27 October 2026 | The source returns, requests SVB5.ver and metadata.json, and submits three Supervisor / 12345 login attempts. | Previdian decoy telemetry. | | 2 November 2026 | A further round of supermarket refrigeration incidents is [reported across several European countries](https://decipher.sc/incidents/second-wave-of-suspected-cyberattacks-hits-european-supermarket-freezers/?ref=blog.previdian.com). | Public incident reporting. | # What Operators Should Check The business case for remote management is a sound one. These systems are spread across multiple locations and countries. Managing each one individually would be a logistical nightmare. But if they’re reachable over the internet, the basic security has to be right. Here’s where we’d start: 1. **Remove Direct Public Access to Management Interfaces.** Coordinate with the refrigeration provider so monitoring and maintenance can continue through a secure VPN or protected management network. 2. **Apply the Latest Supported Firmware for the Exact Model.** Danfoss's [security advisories](https://www.danfoss.com/en/service-and-support/coordinated-vulnerability-disclosure/danfoss-security-advisories/?ref=blog.previdian.com) identify version 4.2 as the fix threshold for CVE-2025-41450\. The separate CVE-2025-41451 and CVE-2025-41452 issues affect versions before 4.3.1\. Follow the vendor's current upgrade instructions rather than treating those historical versions as the latest release. 3. **Review Every Account.** Replace default or weak credentials, use unique passwords and remove accounts that are no longer needed. Enable the vendor's recommended security settings, including Strict mode where supported and applicable. 4. **Check Operational Settings and Access History.** Investigate unexpected account names, privileges, temperature settings, defrost schedules, alarms, JUDRUD, or remote sessions. In retained HTTP logs, look for the request sequence described above and access from `188.208.141[.]210`. A match is an investigation lead, not proof of compromise. 5. **If Compromise Is Suspected, Preserve Evidence and Coordinate Recovery.** Work with the refrigeration provider and incident responders to restore a trusted configuration and close the access path. A reset alone will not address an exposed, vulnerable system. CERT-FR’s [recovery and protection guidance](https://www.cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-012/?ref=blog.previdian.com) is a useful starting point for affected operators. # Conclusions It’s hard to defend an administrative access code that can be worked out from the date. And regardless of the firmware version, nobody should leave a refrigeration system reachable with a default password from a setup manual. We don’t know whether JUDRUD was behind the attempts against our decoy. We don’t know whether the same person was responsible for the wider European attacks, either. The post’s reference to French protests doesn’t tell us whether this was hacktivism. And we don’t have evidence that lets us attribute the activity to Russia. If a company says it captured these attacks in its honeypots, we’d like to see the requests and dates. If it says it knows who was behind them, we’d like to see what connects that actor to the attacks. These incidents are worrying enough without adding more fear, uncertainty and doubt. If this kind of intelligence would be useful to your team, [get in touch](https://previdian.com/contact?ref=blog.previdian.com). We’d be happy to show you what we’re seeing against the products you run (including your fridges!).