Hackers Targeted Refrigeration Systems Using Basic Passwords
Security researchers used honeypots to expose cyberattacks against French and Swedish cooling infrastructure.
1Honeypot Strategy Reveals Tactics
Following massive cyberattacks on French grocery store cooling systems, researchers at Sekoia deployed four fake refrigeration units online. This honeypot strategy allowed experts to monitor incoming threats in real-time. By observing these interactions, investigators successfully identified the specific methods hackers utilized to probe for vulnerabilities within critical industrial control systems.
2Weak Passwords and Vulnerabilities
During the observation period, researchers recorded over twenty intrusion attempts against their decoy systems. One attacker notably attempted to gain access using the extremely weak password '12345'. By November 1, the team identified a critical security flaw that could grant administrative privileges to unauthorized users without requiring any password authentication at all.
3Impact on Swedish Infrastructure
Just one day after the identified vulnerability was documented, approximately thirty Swedish businesses reported similar cyberattacks on their refrigeration systems. These incidents mirrored the earlier French attacks, where attackers manipulated temperatures and altered alarm thresholds. These deliberate actions were designed to delay detection while causing significant spoilage of stored food products.
4Technical Manipulation of Systems
The attackers demonstrated a sophisticated understanding of industrial control systems by manipulating operational parameters. By triggering defrost cycles and changing alarm limits, they maintained control while remaining hidden from operators. John Billow of the National Cybersecurity Center confirmed that attackers often gained full administrative access, allowing them complete control over system functions.
5Cross-Border Attack Patterns
Authorities have noted striking similarities between the incidents in France and Sweden. John Billow confirmed that the methods and exploited vulnerabilities were nearly identical in both countries. This pattern suggests a coordinated or highly standardized approach by the threat actors, regardless of the specific geographic targets involved in the ongoing campaign.
6Attribution Challenges Remain
While French officials have previously pointed to the Iranian Revolutionary Guard as the perpetrators behind the attacks in France, the situation in Sweden remains less clear. Investigators are currently conducting a time-consuming analysis to determine the responsible actors. Officials admit that obtaining a complete picture of the perpetrators is not always possible.
7Operational Risks to Food
The primary objective of these attacks appears to be the disruption of food supply chains through the destruction of inventory. By forcing temperatures to fluctuate, hackers caused millions of kronor in losses in France alone. This highlights the severe vulnerability of modern, internet-connected industrial refrigeration systems to remote, malicious cyber interference.
8Ongoing Security Investigations
As investigations continue, the focus remains on identifying the specific entry methods used against Swedish targets. Cybersecurity experts emphasize that the analysis is complex and requires significant time to verify. Until the investigation concludes, the exact identity of the attackers behind the Swedish incidents remains officially unconfirmed by national security authorities.
Original article: SVT – Inrikes — Hackers Targeted Refrigeration Systems Using Basic Passwords