In early 2026, attackers remotely triggered defrost cycles on commercial refrigeration systems at multiple French supermarket chains overnight, forcing stores to shut down refrigerated cases and destroying perishable inventory. According to reporting on the incident, the attack targeted Danfoss refrigeration controllers — the embedded OT devices that manage compressors, evaporators, and defrost scheduling across cold-chain infrastructure.
This is not a data breach story. This is a kinetic-impact cyberattack against operational technology: no ransomware note, no exfiltration — just direct manipulation of physical process controls to cause financial damage and disruption. For defenders, the lesson is blunt: refrigeration controllers, building management systems, and other 'invisible' OT assets are internet-reachable attack surface, and threat actors have demonstrated both the capability and the willingness to weaponize them.
If your organization operates retail, cold storage, food logistics, healthcare refrigeration, or any facility with remotely managed HVAC/R controllers, treat this as an active threat to your environment — not a curiosity.
Technical Analysis
Affected Systems
The attack reportedly targeted Danfoss refrigeration control systems deployed across multiple French supermarket chains. Danfoss controllers (such as the AK-SC series system managers and AK-CC case controllers commonly deployed in European retail) coordinate:
- Compressor rack operation and suction/discharge pressure setpoints
- Case temperature setpoints
- Defrost scheduling and on-demand defrost initiation — the function abused in this attack
- Alarm thresholds and alarm suppression
These devices are typically managed through a centralized system manager interface, often reachable over TCP/IP for remote monitoring by refrigeration contractors and facilities management vendors.
How the Attack Works (Defender's View)
No CVE has been publicly attributed to this campaign, and none is cited in the reporting. Based on the observed behavior — remote defrost triggering across multiple chains simultaneously — the most probable attack chain is:
- Discovery: Internet-wide scanning (Shodan, Censys) for exposed Danfoss system managers, proprietary management ports, or remote access gateways (e.g., vendor remote service tunnels, TeamViewer/AnyDesk on gateway PCs, exposed VNC/RDP to front-end servers).
- Access: Exploitation of default/weak credentials on the management interface, an unpatched remote access service, or compromise of a third-party refrigeration maintenance provider with legitimate remote access to multiple chains — which would explain the multi-victim simultaneity.
- Impact: Issuing legitimate controller commands — initiating defrost cycles, raising case temperature setpoints, or silencing alarms — via the controller's own management protocol. No malware is required. The attacker uses the system's designed functionality against it, which is why traditional endpoint detection never fires.
This 'living off the OT land' pattern is the defining characteristic of the incident: the malicious action is indistinguishable from legitimate maintenance commands at the protocol level. Detection must therefore focus on who issued the command, from where, and when — not on the command itself.
Exploitation Status
- Confirmed active, coordinated exploitation against multiple retail chains in France.
- No CVE assigned in available reporting; the vector appears to be exposed management interfaces and/or credential abuse rather than a memory-corruption vulnerability.
- Not currently listed in CISA KEV (no CVE exists to list).
- Danfoss ecosystem devices have a documented history of exposure via internet search engines, and default-credential risk in deployed fleets is well known to OT practitioners.
Why This Matters Beyond Supermarkets
The same controller classes and the same architectural mistakes — flat networks, vendor remote access without MFA, default credentials, no command auditing — exist in hospital pharmacy refrigeration, blood banks, pharmaceutical cold chain, and data center cooling. The French incident is a proof of concept for any sector where temperature equals safety or revenue.
Detection & Response
The highest-fidelity detection opportunities for this threat class are: (1) connections to OT management interfaces from unauthorized sources, (2) after-hours command activity against controllers, (3) configuration/setpoint changes outside change windows, and (4) exposed management interfaces reachable from the internet. The rules below assume you are shipping OT network sensor logs, firewall logs, or Sysmon data from gateway/jump hosts into your SIEM.
SIGMA Rules
---
title: Unauthorized Connection to OT Refrigeration Management Interface
id: 3f8c2a71-5b9d-4e6a-b1c7-9d4e2f8a6c05
status: experimental
description: Detects network connections to common ICS/refrigeration management ports (Modbus TCP, Danfoss system manager, web admin) originating from hosts outside the authorized OT management/jump-host set. Tune the filter to your environment's authorized engineering workstations and vendor jump hosts.
references:
- https://www.bleepingcomputer.com/news/security/cyberattack-shuts-down-refrigerators-at-french-supermarkets/
- https://attack.mitre.org/techniques/T0885/
author: Security Arsenal
date: 2026/02/10
tags:
- attack.impact
- attack.t0885
- attack.t0822
logsource:
category: network_connection
product: windows
detection:
selection:
DestinationPort:
- 502
- 10001
- 443
- 80
DestinationIp|startswith:
- '10.10.'
- '192.168.50.'
filter_authorized_sources:
SourceIp:
- '10.10.0.15'
- '10.10.0.16'
condition: selection and not filter_authorized_sources
falsepositives:
- Legitimate vendor maintenance from new IP addresses
- Network scans from sanctioned vulnerability management tools
level: high
---
title: Remote Access Tool Execution on OT Gateway or Jump Host
id: 8b2d4e91-3c7a-4f5d-a6e8-1b9c3d7f2a04
status: experimental
description: Detects execution of remote access tools (TeamViewer, AnyDesk, VNC variants) on OT gateway systems. Compromise of vendor remote access pathways is a likely vector in multi-site refrigeration controller attacks.
references:
- https://www.bleepingcomputer.com/news/security/cyberattack-shuts-down-refrigerators-at-french-supermarkets/
- https://attack.mitre.org/techniques/T1219/
author: Security Arsenal
date: 2026/02/10
tags:
- attack.command_and_control
- attack.t1219
logsource:
category: process_creation
product: windows
detection:
selection_img:
Image|endswith:
- '\TeamViewer.exe'
- '\TeamViewer_Service.exe'
- '\AnyDesk.exe'
- '\vncserver.exe'
- '\winvnc.exe'
- '\tvnserver.exe'
- '\rustdesk.exe'
- '\ScreenConnect.ClientService.exe'
selection_cli:
CommandLine|contains:
- 'teamviewer'
- 'anydesk'
- 'rustdesk'
condition: 1 of selection_*
falsepositives:
- Sanctioned vendor remote maintenance — enforce allowlisting of specific tools and approved session windows
level: medium
---
title: Modbus Write or Function Code Anomaly from Non-Engineering Host
id: 5c7a1f83-2e9b-4d4c-9a3f-7e1b6d8c4a12
status: experimental
description: Detects Sysmon/network telemetry showing a non-engineering workstation initiating connections to Modbus TCP port 502, indicative of unauthorized command issuance to industrial controllers such as refrigeration system managers.
references:
- https://www.bleepingcomputer.com/news/security/cyberattack-shuts-down-refrigerators-at-french-supermarkets/
- https://attack.mitre.org/techniques/T0855/
author: Security Arsenal
date: 2026/02/10
tags:
- attack.ics
- attack.t0855
- attack.t0883
logsource:
category: network_connection
product: windows
detection:
selection:
DestinationPort: 502
Initiated: 'true'
filter_engineering:
Image|endswith:
- '\engineering_tool.exe'
condition: selection and not filter_engineering
falsepositives:
- SCADA polling servers — restrict via DestinationIp scoping to known controller subnets
level: high
KQL — Microsoft Sentinel / Defender Hunt
Hunt for connections to OT management ports from non-authorized sources, plus after-hours remote access sessions on gateway hosts. Tune the authorized source list to your jump hosts and vendor VPN egress addresses.
// Hunt 1: Connections to refrigeration/ICS management ports from non-authorized hosts
let AuthorizedOTSources = dynamic(["10.10.0.15", "10.10.0.16", "10.20.5.100"]);
let OTPorts = dynamic([502, 10001, 20000, 44818]);
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemotePort in (OTPorts)
| where not(LocalIP in (AuthorizedOTSources))
| where RemoteIP startswith "10." or RemoteIP startswith "192.168." or RemoteIP startswith "172.16."
| summarize ConnectionCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Devices = dcount(DeviceName)
by DeviceName, LocalIP, RemoteIP, RemotePort, InitiatingProcessFileName
| order by ConnectionCount desc;
// Hunt 2: After-hours remote access tool execution on OT gateways (attackers struck overnight)
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName in~ ("TeamViewer.exe", "AnyDesk.exe", "winvnc.exe", "rustdesk.exe", "ScreenConnect.ClientService.exe")
or ProcessCommandLine has_any ("teamviewer", "anydesk", "rustdesk")
| extend HourUtc = datetime_part("hour", TimeGenerated)
| where HourUtc < 6 or HourUtc > 20
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, HourUtc
| order by TimeGenerated desc;
Velociraptor VQL
Deploy this artifact to OT gateway / jump hosts to identify active remote access sessions and unexpected outbound/inbound connections to controller subnets.
-- Audit OT gateway hosts for remote access tooling and connections to controller segments
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)(teamviewer|anydesk|vnc|rustdesk|screenconnect)'
OR CommandLine =~ '(?i)(teamviewer|anydesk|rustdesk)'
-- Network connections touching common ICS/management ports
SELECT Pid, Name, Status, SrcIP, SrcPort, DstIP, DstPort
FROM netstat()
WHERE DstPort in (502, 10001, 20000, 44818)
AND Status =~ 'ESTAB'
Remediation / Exposure Audit Script
Run from a management host to audit which refrigeration/OT management interfaces are reachable across segments they shouldn't be, and to verify firewall segmentation. For the internet-exposure piece, pair this with an external Shodan/Censys review of your public IP ranges.
#!/bin/bash
# OT refrigeration controller exposure audit — run from a management/jump host
# Checks which controller management ports are reachable from NON-OT segments.
# Any response from this scan originating outside the OT VLAN is a segmentation failure.
OT_SUBNETS="192.168.50.0/24 10.10.0.0/24" # <-- replace with your controller subnets
OT_PORTS="502,10001,20000,44818,80,443"
echo "=== Scanning OT subnets for reachable management interfaces ==="
for SUBNET in $OT_SUBNETS; do
echo "[+] Subnet: $SUBNET"
nmap -Pn -sT -p "$OT_PORTS" --open "$SUBNET" -oG - | awk '/Up/{print $2, $4}'
done
echo ""
echo "=== Checking for default-credential web interfaces (HTTP 200 on port 80/443) ==="
for SUBNET in $OT_SUBNETS; do
nmap -Pn -p 80,443 --open "$SUBNET" -oG - | grep 'Up' | awk '{print $2}' | while read -r HOST; do
CODE=$(curl -sk -o /dev/null -w '%{http_code}' --max-time 5 "http://$HOST/")
[ "$CODE" = "200" ] && echo "[!] Web admin reachable: http://$HOST/ (HTTP $CODE) — verify auth required"
done
done
echo ""
echo "=== ACTION REQUIRED ==="
echo "1. Any host reachable above from an IT segment must be firewalled to jump-host-only access."
echo "2. Any web interface responding without authentication must be remediated immediately."
echo "3. Cross-reference results with your external attack surface scan (Shodan/Censys) for public exposure."
Remediation
There is no patch for this incident because there is no CVE — the fix is architectural and operational. Prioritized actions:
- Eliminate internet exposure of refrigeration controllers immediately. Search Shodan/Censys for your public IP ranges and for Danfoss system manager fingerprints. Nothing managing physical process should be directly internet-reachable — full stop.
- Segment OT from IT and from vendor pathways. Controllers should sit on dedicated VLANs reachable only from hardened jump hosts. Enforce deny-by-default firewall rules between IT and OT segments; permit only specific management ports from specific authorized sources.
- Lock down vendor remote access. Require MFA on all third-party maintenance access, route it through a brokered jump solution with session recording, and disable standing access — vendor connections should be just-in-time and time-boxed. The multi-chain simultaneity of this attack strongly suggests a shared access pathway; assume your refrigeration contractor's credentials are a target.
- Rotate all controller credentials. Default and shared passwords on Danfoss system managers are endemic in deployed fleets. Enforce unique per-site credentials stored in a vault.
- Enable and centralize controller audit logging. Setpoint changes, defrost initiation, alarm suppression, and login events must ship to your SIEM. Alert on changes outside approved maintenance windows — the attackers operated overnight for a reason.
- Implement out-of-band physical alerting. Temperature excursions trigger local alarms even if the controller's own alerting is suppressed. Independent sensors on a separate network path catch what a compromised controller won't report.
- Engage Danfoss and your integration vendor. Review Danfoss security guidance for your specific controller/system manager models, apply available firmware updates, and confirm hardening baselines. Monitor CISA ICS advisories for any advisory issued in connection with this campaign.
- Add OT sabotage to your IR playbooks. This incident type — no malware, no ransom note, just process manipulation — breaks traditional IR assumptions. Your playbook needs a branch for 'unauthorized legitimate commands' with procedures for manual local control fallback.
Conclusion
The French supermarket attack is a milestone in OT threat evolution: financially motivated disruption via legitimate control functions, executed against multiple victims simultaneously, with zero malware deployed. Every detection stack tuned exclusively for payloads and persistence will miss this class of attack entirely.
Defenders must shift to behavioral and architectural controls for OT: strict segmentation, brokered vendor access, command auditing, and anomaly detection keyed to who, when, and from where — not what. If you operate cold chain, HVAC, or building automation infrastructure, run the exposure audit above this week. The attackers have already demonstrated they're scanning.
Related Resources
Security Arsenal Alert Triage Automation AlertMonitor Platform Book a SOC Assessment platform Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.