CISA, FBI, HHS, USDA & DoT Warn: Harden Industrial Refrigeration and Cold Chain Monitoring Systems — Defender's Detection and Remediation Guide

Five US government agencies — CISA, the FBI, HHS, USDA, and the Department of Transportation — have jointly issued an urgent call for organizations to harden industrial refrigeration and cold chain monitoring systems against active malicious cyber activity observed globally. This is not a theoretical advisory. The authoring organizations explicitly state they are aware of malicious cyber activity targeting these systems right now, and the blast radius is significant: the Healthcare and Public Health, Chemical, Food and Agriculture, and Transportation Systems sectors all depend on these systems for automated and remote temperature monitoring, continuous temperature logging, defrost cycle management, and energy optimization.

For defenders, the stakes go well beyond spoiled inventory. In healthcare and pharmaceutical environments, a compromised cold chain monitoring system can silently invalidate vaccine and biologics storage — a patient safety event, not just an IT incident. In food and agriculture, manipulated temperature logs can mask contamination events or trigger fraudulent spoilage claims. In refrigerated transport, tampered telemetry can disrupt an entire distribution network. Attackers understand that these systems sit at the intersection of OT and physical outcomes, and they are increasingly reachable because they are, by design, remotely monitored.

This post breaks down the threat from a practitioner's perspective: why these systems are attractive targets, what the attack surface actually looks like, how to hunt for compromise on both the IT and OT side of the boundary, and exactly what to remediate first.

Technical Analysis

What These Systems Actually Are

Industrial refrigeration and cold chain monitoring deployments typically combine:

• Embedded controllers and PLCs managing compressors, condensers, and defrost cycles
• Temperature sensors and data loggers performing continuous logging for regulatory compliance (FDA 21 CFR Part 11, USDA FSIS requirements, CDC vaccine storage guidance)
• Remote monitoring gateways — often cellular (LTE/4G/5G) or Ethernet-connected devices that bridge the OT network to vendor cloud dashboards
• HMIs and engineering workstations used for configuration, alarming, and setpoint changes
• Cloud telemetry platforms operated by OEMs and third-party monitoring service providers

The Attack Surface

While the joint advisory does not attribute the activity to a specific named actor or cite a single CVE, the observed targeting pattern aligns with a well-documented class of ICS/OT intrusion techniques. From a defender's perspective, the realistic attack chain against cold chain infrastructure looks like this:

1. Initial access via internet-exposed remote access. Shodan-indexable monitoring gateways, vendor remote support tunnels (persistent VPN clients, TeamViewer/AnyDesk-style agents on engineering workstations), and web interfaces with default or weak credentials are the most common entry points we see in IR engagements involving building automation and refrigeration controllers.

2. Abuse of insecure-by-design OT protocols. Modbus TCP, BACnet/IP, and SNMP are ubiquitous in refrigeration control and carry no authentication or encryption. Any host that can reach the control network can read registers and, in the case of Modbus function codes 5/6/15/16, write coil and register values — which translates directly to setpoint changes, alarm suppression, and defrost cycle manipulation.

3. Lateral movement from IT to OT. Flat networks are the norm in facilities environments. A phished corporate credential on a facilities-management workstation frequently yields a path to the OT VLAN through shared jump hosts, unpatched Windows HMIs, or poorly segmented vendor remote access accounts.

4. Impact on physical processes. Objectives observed in analogous campaigns include temperature setpoint manipulation, disabling or altering alarm thresholds, falsifying continuous temperature logs (directly threatening regulatory compliance and product integrity), and encrypting or wiping monitoring infrastructure as part of extortion-driven operations.

Exploitation Status

The advisory describes confirmed malicious cyber activity occurring globally — this is in-the-wild targeting, not theoretical risk. No specific CVE or CISA KEV entry is cited in the joint guidance; the defensive burden is on architectural hardening, exposure reduction, and detection of unauthorized access and manipulation rather than patching a single vulnerability. That is precisely why this class of threat is dangerous: you cannot patch your way out of a flat network with a default-password gateway hanging off the internet.

Sectors and Assets in Scope

• Healthcare and Public Health: hospital pharmacy refrigeration, blood bank storage, vaccine cold chain, laboratory sample storage
• Food and Agriculture: processing plants, cold storage warehouses, distribution centers
• Chemical: temperature-sensitive reagent and product storage
• Transportation Systems: refrigerated trucks, rail, intermodal reefer containers, and their telematics platforms

Detection & Response

The detections below target the observable behaviors that matter: exposure of OT remote access on the public internet, IT hosts communicating directly with OT control protocols, suspicious remote access tooling on engineering workstations, and evidence of log or configuration tampering. Tune thresholds to your environment — the goal is high-fidelity signal at the IT/OT boundary, not broad sweeps.

Sigma Rules

---
title: Remote Access Tool Execution on OT Engineering or HMI Workstation
id: 3c8e2f51-7a4d-4b9e-9f1a-2d5c6e8b0a11
status: experimental
description: Detects execution or installation of common remote access tools on workstations designated as OT engineering stations or HMIs. Adversaries targeting industrial refrigeration and cold chain monitoring systems frequently leverage legitimate remote access software to reach OT assets, consistent with CISA/FBI/HHS/USDA/DoT joint guidance on hardening these systems.
references:
  - https://www.cisa.gov/resources-tools/resources/us-government-partners-urge-hardening-industrial-refrigeration-and-cold-chain-monitoring-systems
  - https://attack.mitre.org/techniques/T1219/
author: Security Arsenal
date: 2026/02/14
tags:
  - attack.command_and_control
  - attack.t1219
logsource:
  category: process_creation
  product: windows
detection:
  selection_host:
    Hostname|contains:
      - 'HMI'
      - 'ENG-WS'
      - 'OT-WS'
      - 'SCADA'
      - 'FACIL'
  selection_img:
    Image|endswith:
      - '\teamviewer.exe'
      - '\anydesk.exe'
      - '\screenconnect.exe'
      - '\logmein.exe'
      - '\splashtop.exe'
      - '\ammyy.exe'
      - '\rustdesk.exe'
  condition: selection_host and selection_img
falsepositives:
  - Approved vendor remote support sessions — maintain an allowlist of sanctioned tools and scheduled maintenance windows
level: high
---
title: Suspicious Modbus Write Function Code in OT Network Traffic
id: 6d1a4c28-3f7e-4a2b-8c9d-5e2f7a1b3d44
status: experimental
description: Detects Modbus TCP write operations (function codes 5, 6, 15, 16) originating from hosts outside the authorized engineering workstation set. Unauthorized register/coil writes against refrigeration controllers can alter temperature setpoints, suppress alarms, or manipulate defrost cycles, as described in the joint US government advisory on cold chain system targeting.
references:
  - https://www.cisa.gov/resources-tools/resources/us-government-partners-urge-hardening-industrial-refrigeration-and-cold-chain-monitoring-systems
  - https://attack.mitre.org/techniques/T0855/
author: Security Arsenal
date: 2026/02/14
tags:
  - attack.impact
  - attack.t0855
  - attack.ics
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 502
    Initiated: 'true'
  filter_authorized:
    SourceIp:
      - '10.10.20.11'
      - '10.10.20.12'
  condition: selection and not filter_authorized
falsepositives:
  - Newly deployed engineering workstations not yet added to the authorized source list
  - SCADA polling servers performing legitimate control writes
level: high
---
title: Deletion or Clearing of Temperature Logging or OT Event Data
id: 9b2e7d43-1c5a-4f8e-a6d3-8c4b2e1f9a55
status: experimental
description: Detects deletion of files in temperature logging, historian export, or cold chain compliance directories. Falsification or destruction of continuous temperature logs threatens regulatory compliance (FDA 21 CFR Part 11, USDA, CDC vaccine storage) and is a plausible objective in the malicious activity described by CISA, FBI, HHS, USDA, and DoT.
references:
  - https://www.cisa.gov/resources-tools/resources/us-government-partners-urge-hardening-industrial-refrigeration-and-cold-chain-monitoring-systems
  - https://attack.mitre.org/techniques/T1070/
author: Security Arsenal
date: 2026/02/14
tags:
  - attack.defense_evasion
  - attack.t1070.004
logsource:
  category: file_delete
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - '\TemperatureLogs\'
      - '\ColdChain\'
      - '\Historian\Export\'
      - '\ReeferData\'
      - '\Compliance\Logs\'
  condition: selection
falsepositives:
  - Automated log rotation and archival jobs — scope out the rotation service account and process
level: medium

A note on tuning: the authorized-source IPs and directory paths in these rules are placeholders. Pull the real engineering workstation IPs from your OT asset inventory and the real logging paths from your historian vendor documentation before deploying. The Modbus rule assumes your sensor can see OT network traffic — if your network firewall or OT monitoring platform (Claroty, Nozomi, Dragos, Microsoft Defender for IoT) is the telemetry source, port this logic there rather than relying on host-based network connection events.

KQL — Microsoft Sentinel / Defender

This hunt identifies internet-facing connections to OT protocol ports and unexpected inbound sessions to cold chain or OT-segment assets, using CommonSecurityLog (firewall/CEF ingestion) and DeviceNetworkEvents. It is designed to catch both exposed remote access and IT-to-OT protocol abuse — the two most probable initial access and lateral movement vectors in this campaign class.

// Hunt: Inbound connections to OT/cold chain protocol ports from non-OT sources
// Covers Modbus (502), BACnet/IP (47808), SNMP (161), and common remote access (3389/5900/5938/6568)
let OtSubnets = dynamic(["10.10.20.0/24", "172.16.30.0/24"]); // replace with your OT segments
let OtPorts = dynamic([502, 47808, 161, 20000, 44818]); // Modbus, BACnet, SNMP, proprietary, EtherNet/IP
let ApprovedOtSources = dynamic(["10.10.20.11", "10.10.20.12"]); // engineering workstations
union isfuzzy=true
    (CommonSecurityLog
    | where TimeGenerated > ago(7d)
    | where DestinationPort in (OtPorts)
    | where not(SourceIP in (ApprovedOtSources))
    | where not(ipv4_is_in_any_range(SourceIP, OtSubnets))
    | summarize ConnectionCount=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated)
      by SourceIP, DestinationIP, DestinationPort, DeviceAction
    | extend TelemetrySource = "Firewall"),
    (DeviceNetworkEvents
    | where TimeGenerated > ago(7d)
    | where RemotePort in (OtPorts) or RemotePort in (3389, 5900, 5938, 6568)
    | where ActionType == "InboundConnectionAccepted"
    | summarize ConnectionCount=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated)
      by DeviceName, LocalIP, RemoteIP, RemotePort, InitiatingProcessFileName
    | extend TelemetrySource = "Defender")
| sort by ConnectionCount desc

Run the Defender half of this query against any host whose name or tag indicates HMI, engineering workstation, historian, or facilities management. Any inbound RDP/VNC/TeamViewer session to an OT-adjacent host from an IP outside your approved vendor support ranges warrants immediate triage.

Velociraptor VQL

This artifact hunts endpoints for active remote access tooling and network listeners consistent with unauthorized remote support tunnels on OT-adjacent Windows systems — the persistence and access mechanism of choice for intrusions into facilities environments.

-- Hunt: Remote access tools and suspicious listeners on OT-adjacent endpoints
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)(teamviewer|anydesk|screenconnect|logmein|splashtop|rustdesk|ammyy|vnc)'
   OR CommandLine =~ '(?i)(teamviewer|anydesk|screenconnect|rustdesk)'

-- Companion: enumerate listeners on remote access and OT protocol ports
SELECT Pid, Name, LocalAddr, LocalPort, RemoteAddr, RemotePort, Status
FROM netstat()
WHERE Status =~ 'LISTEN'
  AND (LocalPort in (3389, 5900, 5938, 6568, 502, 47808, 44818))

Deploy this as a hunt scoped to your facilities, HMI, and engineering workstation collections. Cross-reference any hits against your approved remote support tool inventory and vendor maintenance schedules.

Hardening & Verification Script

For Windows-based HMI and engineering workstations, this script audits inbound exposure: it reports listening services on OT and remote access ports, enumerates installed remote access software, and verifies that the host firewall blocks inbound OT protocol traffic from non-approved sources. Run it elevated on each OT-adjacent Windows asset and reconcile the output against your approved configuration baseline.

# Cold Chain / OT Workstation Exposure Audit - Security Arsenal
# Run elevated on HMI / engineering workstations. Review output; do not auto-remediate on live OT.

$OtPorts = 502, 47808, 44818, 161, 20000
$RaPorts = 3389, 5900, 5938, 6568
$ApprovedOtSources = @('10.10.20.11', '10.10.20.12')  # engineering workstations / SCADA servers

Write-Host '=== [1] Listening ports on OT and remote access services ===' -ForegroundColor Cyan
Get-NetTCPConnection -State Listen -ErrorAction SilentlyContinue |
  Where-Object { $_.LocalPort -in ($OtPorts + $RaPorts) } |
  Select-Object LocalAddress, LocalPort, OwningProcess,
    @{N='ProcessName';E={(Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName}} |
  Format-Table -AutoSize

Write-Host '=== [2] Installed remote access software ===' -ForegroundColor Cyan
$RaTools = 'TeamViewer','AnyDesk','ScreenConnect','LogMeIn','Splashtop','RustDesk','Ammyy','TightVNC','UltraVNC'
Get-ItemProperty HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*,
  HKLM:\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\* -ErrorAction SilentlyContinue |
  Where-Object { $n = $_.DisplayName; $RaTools | Where-Object { $n -like "*$_*" } } |
  Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | Format-Table -AutoSize

Write-Host '=== [3] Firewall rules permitting inbound OT protocol traffic ===' -ForegroundColor Cyan
Get-NetFirewallRule -Direction Inbound -Action Allow -Enabled True -ErrorAction SilentlyContinue |
  Get-NetFirewallPortFilter -ErrorAction SilentlyContinue |
  Where-Object { $_.LocalPort -in ($OtPorts + $RaPorts) } |
  Select-Object DisplayName, LocalPort, Protocol | Format-Table -AutoSize

Write-Host '=== [4] Create restrictive inbound rule for OT ports (approved sources only) ===' -ForegroundColor Cyan
# Remove existing broad allow rules for OT ports, then create scoped rules. Uncomment to enforce.
# Get-NetFirewallRule -Direction Inbound -Action Allow |
#   Get-NetFirewallPortFilter | Where-Object { $_.LocalPort -in $OtPorts } |
#   ForEach-Object { Disable-NetFirewallRule -Name $_.Name }
# New-NetFirewallRule -DisplayName 'OT-Modbus-Approved-Only' -Direction Inbound -Protocol TCP `
#   -LocalPort 502 -RemoteAddress $ApprovedOtSources -Action Allow -Profile Any
# New-NetFirewallRule -DisplayName 'OT-Block-Modbus-All-Other' -Direction Inbound -Protocol TCP `
#   -LocalPort 502 -Action Block -Profile Any

Write-Host '=== [5] RDP exposure check ===' -ForegroundColor Cyan
$rdp = Get-ItemProperty 'HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server' -Name fDenyTSConnections -ErrorAction SilentlyContinue
if ($rdp.fDenyTSConnections -eq 0) { Write-Warning 'RDP is ENABLED on this host. Disable or restrict via GPO and jump host.' }
else { Write-Host 'RDP disabled. Good.' -ForegroundColor Green }

Write-Host 'Audit complete. Reconcile findings against the approved OT baseline before changing production systems.' -ForegroundColor Green

For Linux-based monitoring gateways and historian servers, the equivalent exposure check:

#!/usr/bin/env bash
# Cold chain / OT Linux gateway exposure audit - run as root, review before changing live OT
set -u

echo '=== [1] Listening sockets on OT and remote access ports ==='
ss -tulnp | grep -E ':(502|47808|44818|161|20000|3389|5900|5938|6568)\b' || echo 'None found.'

echo '=== [2] Remote access tooling present ==='
for pkg in teamviewer anydesk rustdesk xrdp tigervnc-server; do
  command -v "$pkg" >/dev/null 2>&1 && echo "FOUND: $pkg"
  systemctl list-units --type=service --state=running 2>/dev/null | grep -i "$pkg"
done

echo '=== [3] Firewall rules exposing OT ports ==='
if command -v nft >/dev/null 2>&1; then nft list ruleset | grep -E '(502|47808|44818|161|20000)';
elif command -v iptables >/dev/null 2>&1; then iptables -L -n -v | grep -E '(502|47808|44818|161|20000)'; fi

echo '=== [4] SNMP community strings (public/private are unacceptable) ==='
grep -RsiE 'com2sec|community' /etc/snmp/ 2>/dev/null | grep -iE 'public|private' \
  && echo 'WARNING: default SNMP community strings detected - rotate and restrict now.'

echo '=== [5] Outbound vendor tunnel connections (verify against approved list) ==='
ss -tnp state established | awk '{print $4, $5, $6}' | sort -u

echo 'Audit complete.'

Remediation

Because this advisory addresses active targeting rather than a single patchable CVE, remediation is architectural. Prioritize in this order:

1. Inventory and eliminate internet exposure — this week. Enumerate every refrigeration controller, monitoring gateway, and telemetry portal. Search Shodan/Censys for your public IP ranges and certificate names against ports 502, 47808, 44818, 161, 20000, and common HMI web interfaces. Nothing on the OT network should be directly internet-reachable. Remote monitoring must traverse a brokered path: VPN with MFA into an IT/OT DMZ, then a hardened jump host.

2. Replace or gate vendor remote access. Persistent vendor tunnels (cellular gateways, always-on VPN clients, unattended remote support agents) are the highest-probability initial access vector in this threat class. Where the vendor connection cannot be removed, require: MFA on vendor accounts, just-in-time enablement (disabled outside maintenance windows), session recording, and dedicated accounts per vendor — never shared credentials.

3. Segment IT from OT. Enforce deny-by-default between corporate and OT VLANs. Permit only explicitly required flows (historian replication, approved polling) through a firewall or unidirectional gateway. Every HMI and engineering workstation should sit in a dedicated OT segment with host firewall rules restricting inbound control protocols to the authorized source list (see script above).

4. Kill default credentials and insecure protocols. Rotate every default password on controllers, gateways, and web interfaces. Disable SNMPv1/v2c or move to SNMPv3 with strong auth; where BACnet or Modbus must remain, assume they are unauthenticated and compensate with network-layer access control.

5. Protect the integrity of temperature logs. Continuous temperature logging is a regulatory artifact — treat it like one. Forward logs off-device to a write-once or immutable store, restrict deletion rights, and alert on log gaps, deletions, and time drift. A manipulated log is indistinguishable from a safe product unless you can prove integrity.

6. Patch and compensate. Apply current firmware from refrigeration controller and gateway OEMs per the joint advisory's guidance. Where legacy devices cannot be patched, isolate them behind the most restrictive segmentation you can enforce and monitor them as presumed-hostile.

7. Build the incident playbook now. Define what a cold chain cyber incident means operationally: who validates product integrity after suspected temperature manipulation, who notifies regulators (FDA, USDA, state health authorities), and how vaccine/biologics inventory is quarantined. In healthcare environments, coordinate this with clinical engineering and pharmacy leadership — they own the physical consequence.

8. Monitor and report. Deploy the detections above, and report suspected activity to CISA via report@cisa.gov or the 24/7 operations center, and to the FBI via IC3 or your local field office, per the joint advisory.

The organizations that weather this campaign will be the ones that treat cold chain monitoring as critical OT infrastructure — segmented, inventoried, and monitored — rather than as facilities equipment nobody owns. The advisory from five federal agencies is your air cover to get budget and change windows approved. Use it.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub