Coldframe: A Honeypot Mimicking Supermarket Refrigeration Controllers
A new open-source tool designed to detect and log unauthorized access attempts on industrial refrigeration systems.
1Simulating Industrial Hardware
Coldframe is a low-interaction honeypot designed to mimic internet-facing refrigeration supervisors like the Danfoss AK-SM 800A and Dixell XWEB EVO. By presenting fake login pages and XML APIs, it lures attackers into interacting with a decoy system, allowing security teams to record malicious activity without exposing actual operational infrastructure.
2Addressing Refrigeration Vulnerabilities
The project responds to 2026 security incidents where attackers exploited default passwords and unpatched firmware to force defrost cycles in European supermarkets. Coldframe serves as a defensive research tool, capturing the specific passwords, exploit payloads, and connection patterns used by threat actors when they scan for vulnerable refrigeration control units globally.
3Technical Persona Implementation
The tool uses two distinct personas to match the fingerprints of real industrial units. It replicates specific HTTP headers, TLS certificate structures, and asset paths found in production hardware. By generating unique self-signed keys for every deployment, it ensures that attackers cannot easily identify the honeypot through static certificate analysis or shared signatures.
4Exploit Logging Capabilities
Coldframe logs every interaction, including login attempts, XML API commands, and Modbus TCP traffic. It specifically tracks attempts to use known vulnerabilities like CVE-2025-41450 or XWEB auth bypasses. Every action, such as clicking a fake defrost button, is recorded as a JSON event, providing granular data on attacker behavior and tactics.
5Deployment and Hardening
Designed for containerized environments, the tool runs on Ubuntu 24.04 using Podman or Docker. It enforces strict security measures, including a read-only filesystem, limited memory usage, and execution within a non-root user namespace. These configurations prevent the honeypot from being used as a pivot point for further attacks on the host network.
6Customization for Realism
To increase authenticity, users can integrate legitimate vendor assets like favicons or firmware index files. By pointing the honeypot to real firmware components, the decoy becomes indistinguishable from genuine controllers to automated scanners. This high-fidelity approach helps in gathering more accurate intelligence on how attackers fingerprint and target specific industrial equipment.
7Safety and Data Integrity
The system is strictly passive, meaning it never executes commands, reads host files, or forwards traffic to external networks. It includes built-in safeguards such as request rate limiting and socket timeouts to prevent resource exhaustion. This ensures that the honeypot remains stable even when subjected to aggressive scanning or automated exploit attempts.
8Strategic Security Value
Coldframe provides a lightweight, effective method for monitoring threats against critical refrigeration infrastructure. By analyzing the generated logs with the included summary script, organizations can identify emerging attack trends. This visibility is essential for hardening real-world industrial systems against unauthorized remote control and potential operational disruptions in the food supply chain.