TL;DR
Get backup power and energy gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Glasgow-based cybersecurity company Lupovis said it detected more than 276 attempts to identify or authenticate against Danfoss AK-SM refrigeration controllers over a 10-day period beginning October 20. The activity peaked October 26 and stopped by the end of the month; the report does not establish that the attempts breached systems or caused damage.
Cybersecurity company Lupovis detected more than 276 attempts targeting Danfoss AK-SM refrigeration controllers over a 10-day period beginning October 20, the company said, with activity peaking on October 26 before stopping by the end of the month. The reported activity preceded a spate of cyber attacks on refrigeration systems, but Lupovis’s findings do not confirm that the attempts succeeded or caused disruption.
According to a report by the trade publication Cooling Post, Lupovis, a Glasgow-based cybersecurity company, identified reconnaissance targeting Danfoss refrigeration controllers from October 20. It counted over 276 attempts associated with 91 different threat actors during the 10-day period. The activity matched specific components of Danfoss controllers, the report said.
Most of the adversaries attempted to authenticate using publicly documented factory-default usernames and passwords. Lupovis’s reported observations describe attempts, not verified access to controllers. The source does not say whether any credentials worked, whether systems were compromised, or whether operators experienced service interruptions.
The report also cites separate figures from cybersecurity firm Forescout Technologies. Forescout said it had tracked more than 20 claimed attacks against refrigeration systems since January. It identified 12,976 internet-exposed service observations across 10 product groups, associated with 6,017 distinct public IP addresses in 99 countries and territories. These are exposure observations, not a count of confirmed compromises.
Risks to Connected Refrigeration
Refrigeration controllers manage equipment used in commercial and industrial cooling. Attempts to access these systems matter because a successful compromise could affect operations, although the supplied report does not document such an outcome in this case. The reported targeting also shows that internet-connected equipment can attract probing even when the activity does not result in a confirmed breach.
The use of factory-default credentials is a specific concern raised by the findings. If those credentials remain unchanged on an exposed device, they could give an attacker a path to attempt access. The available information does not establish how many of the observed devices were vulnerable or whether any site was affected, so the scale of practical risk cannot be determined from these counts alone.
Products Worth Considering
eufy Security 5-Piece Home Alarm Kit
eufy Security Essential 7-Piece Alarm System with HomeBase Mini
Ring Alarm 14-Piece Wireless Security System
As an affiliate, we earn on qualifying purchases.
Separate Reports, Different Counts
The Lupovis findings cover a defined 10-day window and concern reconnaissance and authentication attempts directed at Danfoss AK-SM controllers. Forescout’s figures cover activity tracked since January and a wider set of refrigeration-system services and products. They should not be combined: the reports describe different periods, methods and measures.
Forescout identified Z-Pentest Alliance and NoName057(16) as the most active groups behind the attacks it tracked, describing both as pro-Russian. That attribution belongs to Forescout’s account of its tracked activity; the source does not link those groups specifically to the 276 attempts Lupovis reported. Forescout’s service figures include 7,075 Copeland/Dixell XWEB observations, 4,697 Danfoss StoreView services, 551 Copeland Site Supervisor services, 513 Carel pCOWeb services and 140 services across six other product groups.
“The company detected over 276 attempts coming from 91 different threat actors matching specific components of Danfoss controllers during this 10-day period.”
— Lupovis, as reported by Cooling Post
No Breaches Confirmed in Report
The supplied report does not establish whether any Lupovis-observed authentication attempt succeeded, or whether the targeted controllers were compromised, damaged or taken offline. It also does not provide technical indicators, the locations of affected devices, or a breakdown of attempts by controller or site.
The relationship, if any, between Lupovis’s observations and the later reported attacks is not specified. The 91 threat actors are reported as matching controller components, but the source does not explain how those actors were identified or whether the figure represents distinct individuals or groups. Forescout’s count is explicitly described as claimed attacks, and its exposed-service observations should not be read as confirmed victims.
Operator Checks and Further Findings
The source does not announce a planned investigation, response deadline or next public update from Lupovis, Forescout or Danfoss. Further reporting would be needed to establish whether any attempts resulted in access and whether the activity was connected to the separately reported attacks.
For refrigeration-system operators, the reported use of default credentials points to a practical area to review: whether internet-accessible controllers use unique, current authentication details and whether remote access is appropriately restricted. The source does not state that specific operators have taken these steps, or provide a list of affected installations.
Key Questions
What did Lupovis detect?
Lupovis reported more than 276 attempts targeting Danfoss AK-SM refrigeration controllers over 10 days starting October 20. The activity peaked October 26 and ended by the close of the month.
Were any refrigeration controllers confirmed as compromised?
The supplied report does not confirm a successful breach, damage or disruption. It describes reconnaissance and authentication attempts.
What credentials did most attempts use?
According to the report, most adversaries tried publicly documented factory-default usernames and passwords. It does not say whether any attempt succeeded.
How do Forescout’s figures differ from Lupovis’s?
Forescout reported more than 20 claimed attacks tracked since January and 12,976 exposed-service observations across 10 product groups. Lupovis reported attempts during a separate 10-day period against Danfoss AK-SM controllers; the figures measure different activity.
Were Z-Pentest Alliance and NoName057(16) linked to the Lupovis attempts?
The source says Forescout identified those groups as the most active behind the attacks it tracked. It does not connect them specifically to the attempts Lupovis observed.
Source: coolingpost.com
