CISA Warning on Remote Access to Cold-Chain & Industrial Refrigeration Systems — Detection and Hardening Guide

US federal agencies have issued a joint warning following observed attacks targeting industrial refrigeration and cold-chain monitoring systems — specifically the systems that keep supermarket freezers cold and blood bank storage within safe temperature ranges. The common thread: remote access to these operational technology (OT) assets. Attackers are reaching systems that were never designed to be internet-facing, and the consequences go well beyond spoiled inventory. When a blood storage refrigeration unit drifts out of spec, units of blood products must be destroyed. When a supermarket chain loses cold-chain integrity across a region, the financial and public-health impact is measured in hours.

This is a textbook example of the OT/IT convergence problem I have been briefing CISOs on for years. Cold-chain monitoring platforms — typically built around PLC controllers, embedded HMIs, and vendor-managed remote access tunnels — were deployed for operational convenience, often by facilities teams, with little or no security review. They now sit one Shodan query away from a motivated attacker.

If you operate, manage, or secure any facility with industrial refrigeration — grocery retail, pharmaceutical storage, hospitals, blood banks, food distribution, data center cooling — treat this advisory as actionable today, not informational.

Technical Analysis

What is being targeted

The attacks described in the reporting focus on the remote access layer of cold-chain and industrial refrigeration infrastructure:

• Internet-exposed HMIs and web management interfaces for refrigeration controllers (commonly deployed on TCP ports 80, 443, 8080, and vendor-specific management ports)
• Vendor remote access tunnels and remote desktop gateways standing between corporate networks and OT segments — including RDP exposed directly to the internet and poorly secured VPN concentrators
• Default or weak credentials on embedded controllers, Modbus/BACnet gateways, and remote monitoring portals
• Unsegmented OT networks, where a single compromised monitoring workstation provides lateral movement to refrigeration PLCs and building management systems (BMS)

How the attack works — defender's view of the chain

The observed intrusion pattern follows a sequence familiar to anyone who has worked an ICS incident:

1. Reconnaissance and discovery. Attackers scan for exposed OT management interfaces using internet-wide scanning telemetry (Shodan, Censys, and their own scanning). Refrigeration controllers, BACnet gateways, and remote monitoring portals with identifiable banners are cataloged.
2. Initial access via remote access services. Entry is gained through exposed RDP/VNC, vendor remote support tools, or web interfaces protected by default credentials. No exploit is required — this is T1190 (Exploit Public-Facing Application) at best, and more commonly T1078 (Valid Accounts) against services that should never have been reachable.
3. Persistence and discovery on the OT segment. Once on a monitoring workstation or gateway, attackers enumerate connected controllers, review HMI configurations, and establish secondary access mechanisms (additional accounts, remote access tooling such as AnyDesk/TeamViewer where permitted).
4. Impact. Setpoint manipulation, alarm suppression, disabling of compressor staging, or ransomware detonation on Windows-based monitoring hosts. The physical impact — temperature excursions in blood storage or food cold storage — can be achieved with surprisingly little sophistication once the attacker has write access to controller setpoints.

Exploitation status

• Confirmed active attacks in the wild — this is not a theoretical advisory. US agencies issued the warning precisely because incidents have occurred against supermarket refrigeration and blood storage infrastructure.
• No specific CVE is cited in the reporting; the attack vector is the remote access surface itself — exposed services, default credentials, and flat network architecture — rather than a single patchable vulnerability. This is important: there is no patch for architectural exposure. The remediation is segmentation, access control, and monitoring.
• These intrusions map directly to the MITRE ATT&CK for ICS tactics: Initial Access (T0866/T0819), Discovery (T0840/T0846), and Impact (T0831 Manipulation of Control, T0855 Unauthorized Command Message, T0880 Loss of Safety/Availability analogues).

Detection & Response

Because the attack vector is remote access to OT environments, the highest-fidelity detections concentrate on (a) remote access services reachable from untrusted networks, (b) remote access tooling execution on OT/monitoring hosts, and (c) anomalous interactive logons to systems that should see almost no interactive use.

Sigma Rules

---
title: RDP or VNC Connection to OT or Cold-Chain Monitoring Host
description: Detects inbound remote desktop protocol or VNC network connections to systems identified as OT, building management, or refrigeration monitoring hosts. These systems should rarely, if ever, receive interactive remote sessions from outside a tightly controlled jump-host path.
references:
  - https://www.cisa.gov/topics/industrial-control-systems
  - https://attack.mitre.org/techniques/T1021/001/
  - https://attack.mitre.org/techniques/T1021/005/
author: Security Arsenal
id: 3f7c2a91-6e48-4b5d-9c17-8a2e5f4d6b30
status: experimental
date: 2026/11/15
logsource:
  category: network_connection
  product: windows
detection:
  selection_remote_access:
    DestinationPort:
      - 3389
      - 5900
      - 5901
  filter_ot_naming:
    Computer|contains:
      - '-OT-'
      - '-BMS-'
      - '-HMI'
      - '-SCADA'
      - '-REFRIG'
      - '-COLDCHAIN'
  condition: selection_remote_access and filter_ot_naming
falsepositives:
  - Vendor maintenance windows using approved remote access paths - whitelist the designated jump host source IP and approved maintenance accounts
level: high
---
title: Remote Access Tool Execution on OT or Monitoring Hosts
description: Detects execution of common commercial remote access tools (AnyDesk, TeamViewer, ScreenConnect, Splashtop, RustDesk) on OT segment or cold-chain monitoring hosts. Attackers frequently install these tools for persistence after gaining initial access to exposed remote services.
references:
  - https://attack.mitre.org/techniques/T1219/
  - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-025a
author: Security Arsenal
id: 9d1e4b73-2c56-4f8a-b392-5d8c7a1e4f06
status: experimental
date: 2026/11/15
logsource:
  category: process_creation
  product: windows
detection:
  selection_image:
    Image|endswith:
      - '\anydesk.exe'
      - '\teamviewer.exe'
      - '\teamviewer_service.exe'
      - '\screenconnect.clientservice.exe'
      - '\rustdesk.exe'
      - '\splashtop_streamer.exe'
      - '\sr_service.exe'
      - '\lmserver.exe'
      - '\vncserver.exe'
      - '\tvnserver.exe'
  filter_ot_naming:
    Computer|contains:
      - '-OT-'
      - '-BMS-'
      - '-HMI'
      - '-SCADA'
      - '-REFRIG'
      - '-COLDCHAIN'
  condition: selection_image and filter_ot_naming
falsepositives:
  - Approved vendor remote support tooling - maintain an explicit allowlist of sanctioned tools per host and investigate anything outside it
level: critical
---
title: New Local or Domain Account Creation on OT Monitoring Hosts
description: Detects account creation commands executed on OT, building management, or refrigeration monitoring hosts. Attackers commonly create local accounts for fallback persistence after compromising exposed remote access services.
references:
  - https://attack.mitre.org/techniques/T1136/001/
author: Security Arsenal
id: 5a8f3d21-7b49-4e6c-a185-3c9d2f7b4e18
status: experimental
date: 2026/11/15
logsource:
  category: process_creation
  product: windows
detection:
  selection_cmd:
    CommandLine|contains:
      - 'net user'
      - 'net1 user'
      - 'New-LocalUser'
  selection_add:
    CommandLine|contains:
      - '/add'
      - '-Name'
      - '-Password'
  filter_ot_naming:
    Computer|contains:
      - '-OT-'
      - '-BMS-'
      - '-HMI'
      - '-SCADA'
      - '-REFRIG'
      - '-COLDCHAIN'
  condition: selection_cmd and selection_add and filter_ot_naming
falsepositives:
  - Automated provisioning scripts during system commissioning - baseline creation events and alert only on deviations
level: high

Deployment note: These rules key on host naming conventions. If your OT assets are not named identifiably, replace the filter_ot_naming logic with your OT asset inventory (a lookup of known monitoring host IPs or hostnames) — but get that inventory built regardless; you cannot detect what you have not cataloged.

KQL — Microsoft Sentinel / Defender

The following query hunts for interactive remote logons and remote access tool execution against your OT/cold-chain asset list. Populate the OTAssets datatable with your actual monitoring host inventory — this is what keeps the query surgical instead of noisy.

// Hunt: Remote access activity against cold-chain / OT monitoring assets
// Populate with your refrigeration, BMS, and cold-chain monitoring host inventory
let OTAssets = datatable(HostName:string, Role:string)
[
  "REFRIG-MON-01", "ColdChainMonitoring",
  "BMS-GATEWAY-01", "BMSGateway",
  "HMI-FREEZER-02", "RefrigerationHMI"
];
let RemoteTools = dynamic(["anydesk.exe","teamviewer.exe","teamviewer_service.exe","rustdesk.exe","screenconnect.clientservice.exe","splashtop_streamer.exe","tvnserver.exe","vncserver.exe"]);
let Lookback = 7d;
union isfuzzy=true
(
    SecurityEvent
    | where TimeGenerated > ago(Lookback)
    | where EventID == 4624 and LogonType in (10, 3, 7)  // RemoteInteractive, Network, Unlock
    | where Computer in~ (OTAssets | project HostName)
    | extend SourceIP = IpAddress, AccountName = Account
    | summarize RemoteLogons = count(), DistinctSources = dcount(SourceIP), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
        by Computer, AccountName, SourceIP
    | extend DetectionType = "Interactive Remote Logon"
),
(
    DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where DeviceName in~ (OTAssets | project HostName)
    | where FileName in~ (RemoteTools)
    | summarize ProcessExecutions = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
        by DeviceName, FileName, ProcessCommandLine, InitiatingProcessAccountName
    | extend DetectionType = "Remote Access Tool Execution"
)
| sort by LastSeen desc

For network perimeter visibility, this query identifies inbound connections from the internet to common OT remote access and management ports using firewall data ingested via CEF:

// Hunt: Inbound internet connections to OT remote access and management ports
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DestinationPort in (3389, 5900, 5800, 8080, 8443, 47808, 502, 102)  // RDP, VNC, web mgmt, BACnet, Modbus, S7
| where DeviceAction !in ("deny", "drop", "blocked")
| where ipv4_is_private(SourceIP) == false
| summarize Connections = count(), DistinctSources = dcount(SourceIP), SourceCountries = make_set(SourceIP, 10)
    by DestinationIP, DestinationPort, DeviceVendor
| where DistinctSources > 0
| sort by Connections desc

Velociraptor VQL

This hunt artifact collects process execution, network listeners, and persistence artifacts from Windows-based OT monitoring workstations — the most common pivot point in these intrusions.

-- Artifact: Hunt for remote access tools, suspicious listeners, and persistence
-- Target: Windows OT monitoring / BMS / cold-chain gateway hosts

-- Remote access tooling and suspicious processes
SELECT Pid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)(anydesk|teamviewer|rustdesk|screenconnect|splashtop|vnc|logmein|ammyy)'
   OR CommandLine =~ '(?i)(net user .*/add|net localgroup administrators)'

// Listening services on remote access ports
SELECT Pid, Name, Path, Address, Port, Status
FROM netstat()
WHERE Status =~ 'LISTEN'
  AND Port in (3389, 5900, 5800, 5938, 6568, 3074)
  AND Name !~ '(?i)(svchost|system|lsass)'

// Newly created local user accounts (potential attacker persistence)
SELECT Name, Description, LastLogin
FROM users(local="yes")
ORDER BY LastLogin DESC

Remediation & Hardening Script

Use the following PowerShell script on Windows-based monitoring hosts and gateways to (1) verify RDP exposure, (2) audit for unauthorized remote access tooling, and (3) enforce baseline hardening. Run under an elevated session and test in maintenance windows on OT assets.

# Cold-Chain / OT Monitoring Host Hardening & Audit Script
# Run elevated. Review output before applying changes in production OT environments.

$Report = @()

# 1. Check if RDP is enabled and NLA is enforced
$rdpEnabled = (Get-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections).fDenyTSConnections
$nlaEnabled = (Get-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication).UserAuthentication
$Report += [PSCustomObject]@{Check='RDP Status'; Result = if($rdpEnabled -eq 0){'ENABLED - review necessity'}else{'Disabled'}; Action='If RDP is not operationally required: Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Terminal Server" -Name fDenyTSConnections -Value 1'}
$Report += [PSCustomObject]@{Check='NLA Enforcement'; Result = if($nlaEnabled -eq 1){'Enforced'}else{'NOT enforced'}; Action='Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" -Name UserAuthentication -Value 1'}

# 2. Detect unauthorized remote access tooling
$RATPaths = @("$env:ProgramFiles\AnyDesk","$env:ProgramFiles\TeamViewer","${env:ProgramFiles(x86)}\AnyDesk","${env:ProgramFiles(x86)}\TeamViewer","$env:ProgramData\AnyDesk")
foreach ($p in $RATPaths) {
    if (Test-Path $p) { $Report += [PSCustomObject]@{Check='Remote Access Tool'; Result="FOUND: $p"; Action='Verify this tool is approved. If not: uninstall, capture logs, and initiate IR triage'} }
}

# 3. Audit local administrator accounts
$admins = Get-LocalGroupMember -Group 'Administrators' -ErrorAction SilentlyContinue
$Report += [PSCustomObject]@{Check='Local Admins'; Result=($admins.Name -join '; '); Action='Validate every account. Remove vendor default accounts and any account created outside change control'}

# 4. Verify Windows Firewall is enabled and restricting inbound access
$fw = Get-NetFirewallProfile | Select-Object Name, Enabled
foreach ($profile in $fw) {
    if (-not $profile.Enabled) { $Report += [PSCustomObject]@{Check="Firewall $($profile.Name)"; Result='DISABLED'; Action='Enable-NetFirewallProfile -Profile '+$profile.Name } }
}

# 5. List listening remote access ports for triage
$listeners = Get-NetTCPConnection -State Listen | Where-Object {$_.LocalPort -in 3389,5900,5800,8080,8443} | Select-Object LocalAddress, LocalPort, OwningProcess
foreach ($l in $listeners) {
    $proc = (Get-Process -Id $l.OwningProcess -ErrorAction SilentlyContinue).ProcessName
    $Report += [PSCustomObject]@{Check='Listening Port'; Result="$($l.LocalPort) - $proc"; Action='Confirm business justification; block at host firewall if unneeded'}
}

$Report | Format-Table -AutoSize | Out-String -Width 300
$Report | Export-Csv -Path ".\OT-Hardening-Audit-$(Get-Date -Format yyyyMMdd).csv" -NoTypeInformation
Write-Output "Audit complete. Review findings before applying changes to production OT systems."

Remediation

There is no single patch for this threat — the remediation is architectural and procedural. Prioritize in this order:

Immediate (24–72 hours)

1. Inventory and exposure check. Identify every refrigeration controller, cold-chain monitoring portal, BMS gateway, and HMI in your environment. Query Shodan/Censys for your public IP ranges and organization name — if your systems are visible there, assume they have already been cataloged by attackers.
2. Remove direct internet exposure. No industrial refrigeration controller, monitoring HMI, or OT management interface should be directly reachable from the internet. Place them behind a firewall and require VPN plus MFA for any remote access. If a vendor insists on direct exposure for "support," that is a contract and risk conversation to escalate now.
3. Audit vendor remote access. Enumerate every vendor support tunnel, remote maintenance agreement, and installed remote access tool. Disable any that are not actively governed. Require vendors to use your controlled jump-host path with MFA, session recording, and time-boxed access windows.
4. Change default and shared credentials. Reset passwords on all refrigeration controllers, gateways, and monitoring portals — especially any still running factory defaults. Where the platform supports it, enforce unique credentials per device and per technician.

Near-term (2–4 weeks)

5. Segment OT from IT. Implement or validate firewall rules isolating the OT/cold-chain VLAN from general corporate networks. Deny by default; permit only the specific flows required for monitoring (e.g., historian replication outbound, not inbound administration from user subnets). Follow the CISA/EPA guidance on network segmentation for control systems.
6. Deploy monitoring. Forward logs from OT gateways, monitoring hosts, and perimeter firewalls to your SIEM. Deploy the Sigma and KQL detections above, tuned to your asset inventory. OT environments are beautifully quiet when healthy — which means even basic detections produce high-fidelity alerts.
7. Establish out-of-band temperature alarming. Critical safety net: independent temperature sensors with cellular-out alerting that do not depend on the same network path as the systems an attacker might manipulate. If an attacker suppresses alarms on the primary monitoring system, the out-of-band path catches the excursion.

Strategic (this quarter)

8. Governance for OT procurement. Any new cold-chain or refrigeration system purchase must pass security review: no default credentials, documented remote access architecture, support for centralized authentication and logging.
9. Incident response runbook for cold-chain loss. Define the operational playbook now: who has authority to isolate the OT network, how product/blood viability decisions are made during a monitoring outage, regulatory notification obligations (FDA, AABB, state health departments for blood products), and vendor escalation contacts.
10. Tabletop the scenario. Run a 90-minute exercise: "Ransomware on the cold-chain monitoring server during a holiday weekend with a blood shipment inbound." The gaps you find will be cheaper to close on paper than during an incident.

For blood storage and healthcare-adjacent facilities, remember the regulatory dimension: temperature excursions and monitoring system compromises can trigger FDA and state reporting obligations, and any connected systems handling ePHI bring HIPAA Security Rule requirements into scope. Document your compensating controls accordingly.

Related Resources

Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub