Experts Question Hacker Claims Regarding European Freezer Attacks
Pro-Russian group NoName057(16) fails to provide credible evidence for cyber sabotage claims.
1Dubious Evidence Claims
The pro-Russian hacking group NoName057(16) claimed responsibility for recent attacks on European refrigeration systems. However, security analysts remain highly skeptical of these assertions. The group published files on the dark web purportedly proving their involvement, but investigations reveal these documents fail to substantiate their claims of a successful cyber operation.
2Recycled Data Exposure
SVT's investigation found that the files released by the hackers contain email addresses and passwords already present in older data leaks. Specifically, 168 out of 171 unique email addresses linked to Danfoss were found in previous breaches. These lists, often sourced from 'stealer logs,' do not represent new or unauthorized system access.
3Technical Vulnerability Context
The attacks targeted refrigeration systems using software from the Danish company Danfoss. These systems often lacked secure network configurations and utilized default passwords, making them susceptible to unauthorized access. Danfoss had previously advised Dutch customers in October to disconnect their systems from the internet and transition to more secure, private network environments.
4Lack of System Proof
Security experts like Sai Molige from Forescout emphasize that the published material lacks internal configuration data or store IDs. Genuine evidence would require data residing exclusively within the victims' own systems. Without such specific, time-stamped proof, the hackers' claims regarding the manipulation of cooling settings remain unverified and lack technical credibility.
5Danfoss Security Stance
Danfoss has officially stated there are no signs of a successful attack against their internal IT infrastructure. The company cannot confirm the information published by the hacking groups and refuses to speculate on the perpetrators. They maintain that the integrity of their core corporate systems remains intact despite the external claims.
6Methodology of Attack
The hackers claim their method is simple, utilizing existing equipment functions rather than malware or ransomware. However, analysts note that many Danfoss units can be accessed without any login credentials at all. This suggests that the attackers may be exploiting known hardware vulnerabilities rather than performing sophisticated credential-based hacking operations.
7Verification Process Explained
SVT utilized traditional journalism combined with digital footprint analysis to verify the hackers' claims. By cross-referencing the leaked files with known databases of stolen credentials, they confirmed the data was recycled. This rigorous verification process highlights the importance of scrutinizing digital evidence before accepting claims made by anonymous hacking collectives.
8Broader Security Implications
This incident underscores the risks associated with industrial control systems connected to the public internet. As infrastructure becomes increasingly digitized, the reliance on default security settings creates significant vulnerabilities. Organizations must prioritize network isolation and robust authentication protocols to prevent opportunistic actors from exploiting known flaws in critical cooling and industrial equipment.
Original article: SVT Nyheter — Experts Question Hacker Claims Regarding European Freezer Attacks