CISA Warning on Cold-Chain OT Attacks: Securing Industrial Refrigeration Systems After EU Blood Bank and Supermarket Intrusions

Federal agencies are telling critical infrastructure operators what many of us in the OT security space have been warning about for years: the refrigeration systems keeping blood products viable and food safe are networked, remotely accessible, and actively under attack.

Following a series of intrusions against French blood banks and European supermarket chains, CISA, the FBI, and partner agencies have issued urgent guidance for organizations operating industrial and commercial refrigeration systems. The attack pattern is consistent and alarming — threat actors are exploiting unpatched vulnerabilities, misconfigurations, and weak or hard-coded credentials in cold-chain controllers to gain remote access and manipulate temperature setpoints. The objective isn't data theft. It's product destruction: spoiled blood inventories, ruined food stock, operational disruption, and potential public safety impact.

If your organization operates refrigerated storage — healthcare facilities, blood banks, pharmaceutical cold chains, grocery logistics, food distribution — this is a now problem, not a Q3 roadmap item.

Technical Analysis

What's Actually Being Targeted

Commercial and industrial refrigeration environments typically consist of:

• Refrigeration controllers (e.g., rack controllers, case controllers, compressor management units) that regulate temperature, defrost cycles, and pressure
• Building management / supervisory systems that aggregate controller data and expose it to operators — frequently over BACnet, Modbus TCP, or vendor-proprietary protocols
• Remote access gateways installed by integrators and HVAC/refrigeration vendors for maintenance — often consumer-grade remote desktop tools, exposed VPN concentrators, or cellular modems with default configurations
• Windows-based engineering workstations used to configure controllers and run vendor software

The attacks described in the federal guidance follow a predictable kill chain:

1. Initial access via the remote access path. Weak or hard-coded passwords on controller web interfaces, vendor maintenance accounts, exposed RDP/VNC, or unpatched flaws in remote access gateways. Many of these devices ship with credentials that cannot be changed, or that integrators never changed from defaults.
2. Discovery of the control environment. Once on the OT segment, attackers enumerate controllers over standard ICS protocols (Modbus TCP/502, BACnet/UDP 47808) which have no native authentication.
3. Manipulation of temperature controls. Write commands against holding registers and setpoints — raising temperatures, disabling alarms, suppressing defrost or alarm notifications to delay detection.
4. Impact. Spoiled inventory discovered hours or days later. In the blood bank cases, the target was literally a life-critical supply chain.

Exploitation Status

This is confirmed active exploitation against production critical infrastructure — not theoretical, not a proof-of-concept. The French blood bank and European supermarket incidents are the public tip of a broader pattern, which is precisely why U.S. agencies moved quickly to issue guidance. No single CVE is the story here; the campaign exploits a class of weaknesses: hard-coded credentials, missing patches, flat networks, and unmanaged remote access. That makes this harder to fix than a single patch Tuesday item — it requires architectural change.

Why This Environment Is Uniquely Exposed

Refrigeration OT sits in a worst-of-both-worlds position:

• It's safety and product critical — temperature excursions destroy inventory and, in healthcare, can endanger patients.
• It's historically unmanaged — often owned by facilities teams, not IT or security. Controllers run firmware that's years old. Remote access was installed by a refrigeration contractor five years ago and nobody remembers the password (or that it's the factory default).
• End-of-life devices are endemic. Many deployed controllers no longer receive firmware updates at all. CISA's guidance explicitly calls for replacing EOL hardware — patching is not an option for devices vendors no longer support.

Detection & Response

Detection in OT environments requires humility. You cannot blindly deploy endpoint agents on controllers, and network-based detection must be passive. The rules and queries below target the most observable parts of this attack chain: remote access tooling landing on OT-adjacent Windows systems, and unexpected traffic to ICS protocol ports. Baseline your environment before enabling any of these in block/alert mode — legitimate integrator maintenance activity will look similar, which is exactly the problem.

Sigma Rules

---
title: Remote Access Tool Execution on OT or Engineering Workstation
id: 3f7a2c91-8d4e-4b6a-9f12-5c8d2e7a4b01
status: experimental
description: Detects execution of common remote access tools frequently used by integrators and abused by attackers to reach OT environments, including refrigeration controller networks. Baseline approved vendor tooling before deployment.
references:
  - https://attack.mitre.org/techniques/T1219/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.command_and_control
  - attack.t1219
logsource:
  category: process_creation
  product: windows
detection:
  selection_image:
    Image|endswith:
      - '\teamviewer.exe'
      - '\teamviewer_service.exe'
      - '\anydesk.exe'
      - '\screenconnect.exe'
      - '\connectwisecontrol.exe'
      - '\logmein.exe'
      - '\ammyy.exe'
      - '\vncserver.exe'
      - '\rustdesk.exe'
  filter_approved:
    CommandLine|contains:
      - 'C:\Program Files\ApprovedVendor'
  condition: selection_image and not filter_approved
falsepositives:
  - Legitimate HVAC/refrigeration vendor remote maintenance sessions — establish an approved tools list and maintenance window baselines
level: high
---
title: Network Connection to ICS Protocol Ports from Non-OT Host
id: 9b4e1d73-2f6a-4c85-a318-7e9c3b5d6f02
status: experimental
description: Detects network connections to Modbus TCP (502), BACnet/IP (47808), or S7 (102) ports from hosts outside the approved OT segment. Refrigeration controller manipulation requires write access over these protocols; connections from IT-side or unexpected hosts are high-fidelity indicators after baselining.
references:
  - https://attack.mitre.org/techniques/T0855/
  - https://attack.mitre.org/techniques/T0885/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.ics
  - attack.t0855
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort:
      - 502
      - 102
      - 47808
  filter_baseline:
    SourceIp|cidr:
      - '10.50.0.0/16'  # Replace with approved OT/HMI/engineering workstation ranges
  condition: selection and not filter_baseline
falsepositives:
  - Approved engineering workstations and historians polling controllers — restrict filter to known authorized source IPs
level: high
---
title: Suspicious Account Creation on Engineering Workstation or OT Gateway
id: 61c8a4f2-7b3d-4e59-b204-8f1a6c9d3e07
status: experimental
description: Detects local account creation via net.exe or net1.exe on systems bridging IT and OT networks. Attackers who compromise remote access paths frequently create persistence accounts on gateway systems.
references:
  - https://attack.mitre.org/techniques/T1136/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.persistence
  - attack.t1136.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\net.exe'
      - '\net1.exe'
    CommandLine|contains:
      - 'user'
      - '/add'
  filter_admins:
    User|contains: 'svc_otadmin'
  condition: selection and not filter_admins
falsepositives:
  - Administrative account provisioning — restrict monitoring scope to OT gateways and engineering workstations where account creation should be rare and change-controlled
level: high

KQL — Microsoft Sentinel / Defender

// Hunt 1: Network connections to ICS protocol ports from hosts outside the OT segment
// Requires Defender for Endpoint or firewall/Syslog ingestion via CommonSecurityLog
let OT_Segment = dynamic(["10.50.0.0/16"]); // Replace with your approved OT ranges
DeviceNetworkEvents
| where RemotePort in (502, 102, 47808)
| where not(ipv4_is_in_range(RemoteIP, "10.50.0.0"))  // Tune to environment
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine,
          RemoteIP, RemotePort, ActionType
| order by TimeGenerated desc;

// Hunt 2: Firewall/Syslog telemetry for Modbus/BACnet write traffic crossing zones
CommonSecurityLog
| where DestinationPort in (502, 47808)
| where DeviceAction !in ("Allow", "allow") or SourceZone != DestinationZone
| summarize ConnectionCount = count(), Destinations = make_set(DestinationIP, 20)
    by SourceIP, DestinationPort, DeviceAction, bin(TimeGenerated, 1h)
| where ConnectionCount > 50   // Tune: enumeration bursts exceed normal polling cadence
| order by ConnectionCount desc;

// Hunt 3: Repeated authentication failures against controller web interfaces or OT gateways
Syslog
| where SyslogMessage has_any ("authentication failure", "Failed password", "login failed")
| where Computer has_any ("ot", "bms", "hvac", "refrig") or Facility == "authpriv"
| summarize FailedAttempts = count(), Sources = make_set(HostIP, 10)
    by Computer, ProcessName, bin(TimeGenerated, 15m)
| where FailedAttempts > 5
| order by FailedAttempts desc;

Velociraptor VQL

-- Hunt for remote access tools and unexpected connections to ICS ports
-- on OT gateway and engineering workstation endpoints
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)(teamviewer|anydesk|screenconnect|logmein|rustdesk|vnc)'
   OR Exe =~ '(?i)(teamviewer|anydesk|connectwise|rustdesk)'

-- Enumerate active connections to ICS protocol ports from this endpoint
SELECT Pid, Name, CommandLine,
       netstat().RemoteAddrIP AS RemoteIP,
       netstat().RemotePort AS RemotePort,
       netstat().Status AS ConnStatus
FROM pslist()
WHERE netstat().RemotePort IN (502, 102, 47808, 44818)
  AND ConnStatus = 'ESTABLISHED'

Hardening & Verification Script

Run this on OT gateway systems and engineering workstations (Linux-based jump hosts or via WSL/SSH against gateways) to audit exposure, and use the nmap portion from a management host to inventory reachable ICS services across the refrigeration segment.

#!/bin/bash
# Cold-Chain OT Exposure Audit — run from a management host with access to the OT VLAN
# Requires: nmap. Adjust the target range to your refrigeration/OT segment.

OT_RANGE="10.50.0.0/24"
REPORT="ot_exposure_audit_$(date +%F).txt"

echo "=== Cold-Chain OT Exposure Audit — $(date) ===" | tee "$REPORT"

# 1. Inventory exposed ICS protocol services (Modbus 502, BACnet 47808, S7 102, EtherNet/IP 44818)
echo "[*] Scanning for exposed ICS protocol services..." | tee -a "$REPORT"
nmap -Pn -p 502,102,47808,44818 --open -oG - "$OT_RANGE" \
  | awk '/Ports/{print $2, $4}' | tee -a "$REPORT"

# 2. Identify controller web interfaces (common hard-coded credential exposure point)
echo "[*] Scanning for controller web interfaces (80/443/8080/8443)..." | tee -a "$REPORT"
nmap -Pn -p 80,443,8080,8443 --open -sV --script http-title "$OT_RANGE" \
  | grep -E "Nmap scan|http-title" | tee -a "$REPORT"

# 3. Check for exposed remote access services reaching the OT segment
echo "[*] Checking for exposed RDP/VNC/SSH on OT segment..." | tee -a "$REPORT"
nmap -Pn -p 22,3389,5900-5910 --open "$OT_RANGE" \
  | awk '/Nmap scan|open/{print}' | tee -a "$REPORT"

# 4. On local gateway: audit listening services and active external sessions
echo "[*] Local listening services on this host:" | tee -a "$REPORT"
ss -tulnp 2>/dev/null | awk 'NR>1{print $1, $5, $7}' | sort -u | tee -a "$REPORT"

echo "[*] Active established sessions to this host:" | tee -a "$REPORT"
ss -tnp state established 2>/dev/null | awk 'NR>1{print $4, $5}' | sort | uniq -c | sort -rn | tee -a "$REPORT"

# 5. Audit local accounts with UID 0 and recently created users
echo "[*] Non-root UID 0 accounts (should be empty):" | tee -a "$REPORT"
awk -F: '$3 == 0 && $1 != "root" {print $1}' /etc/passwd | tee -a "$REPORT"

echo "[*] Audit complete. Review $REPORT and remediate exposed services per CISA guidance." | tee -a "$REPORT"

Remediation

The federal guidance is explicit, and as practitioners we should treat it as a prioritized work order, not a suggestion:

Immediate (this week):

1. Isolate OT systems. Refrigeration controllers and supervisory systems must sit on a segmented VLAN with no direct internet path. Enforce deny-by-default at the IT/OT boundary; permit only documented, brokered flows (historian to SIEM, etc.).
2. Secure or remove remote access. Inventory every remote access path into the cold-chain environment — vendor-installed tools count, especially the ones nobody documented. Remove what's not essential. For what remains: route it through a brokered jump host with MFA, time-bound vendor access, and full session logging. Consumer-grade RATs sitting on OT gateways are an eviction notice waiting to be served.
3. Change every default and hard-coded-adjacent credential. Controller web interfaces, supervisory systems, gateways. Where credentials genuinely cannot be changed (hard-coded), the device goes behind a compensating control — a firewall rule restricting access to a single management IP — and onto the replacement list.
4. Baseline and alarm on temperature and setpoint changes. Spoilage attacks succeed because nobody noticed the setpoint move. Ensure temperature excursions and configuration changes generate alerts to a monitored console — and that alerting doesn't depend solely on the same system an attacker can suppress. Independent out-of-band temperature monitoring is cheap insurance.

Short-term (30 days):

5. Patch critical vulnerabilities on controllers, supervisory software, and remote access gateways per vendor advisories. Where internet-facing flaws exist, treat remediation as emergency change, not routine.
6. Inventory end-of-life devices and build a funded replacement plan. CISA's guidance explicitly includes EOL replacement — an unpatchable controller on your network is permanent residual risk that no compensating control fully retires.
7. Deploy passive OT network monitoring (or at minimum, firewall/span-port telemetry into your SIEM) so Modbus/BACnet write activity from unexpected sources becomes visible. Use the detection content above as a starting point.

Structural:

8. Clarify ownership. If facilities owns refrigeration and security owns nothing below the DMZ, that gap is exactly where these attacks live. Bring cold-chain OT under your asset inventory, vulnerability management, and IR plans. Tabletop a "temperature manipulation at 2 a.m. on a holiday weekend" scenario.
9. Contractual controls for integrators. Vendor maintenance access should require MFA, named accounts, notification on connection, and post-session log review. The integrator's security posture is your attack surface.

For the underlying advisory detail, see the Tenable write-up of the federal guidance and CISA's ICS advisories portal. Healthcare operators should additionally treat blood product storage integrity as a patient-safety reporting issue, not merely an IT incident — involve clinical engineering and quality/regulatory teams in response planning.

Related Resources

Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub