Danfoss Refrigeration Controller Hijacking: How Attackers Heated French Supermarkets to 50°C — OT Detection and Hardening Guide

On the night of October 11, attackers remotely seized control of refrigeration and freezer systems at hundreds of French supermarkets — including stores operated by Les Mousquetaires (Intermarché) — and drove temperatures up to 50°C, forcing chains to destroy spoiled food inventory. The intrusion path was not the POS network, not corporate email, and not a phished credential in the traditional sense. The attackers went straight through the operational technology layer: the centralized controller that manages an entire store's fridges and freezers — a device manufactured by Danish company Danfoss that maintenance firms routinely administer remotely.

This is a watershed incident for OT security in the retail sector. It demonstrates, at national scale and with physical-world consequences, what practitioners have warned about for years: internet-reachable building management and refrigeration controllers, combined with third-party remote maintenance access, form a soft underbelly that requires no zero-day to exploit. The attackers didn't need to burn an exploit — they needed access to a management plane that was, by design, reachable from outside the store.

No CVE has been published in connection with this campaign at the time of writing. This post is therefore focused on the technique — remote hijacking of OT system managers via legitimate remote administration channels — and on the detections and hardening measures that would have caught or prevented it.

Why Defenders Need to Pay Attention Now

If your organization operates supermarkets, cold storage, pharmaceutical refrigeration, food logistics, hospitals with medical-grade cold chain, or any facility with remotely managed HVAC/refrigeration, this attack pattern applies to you directly. The business impact here was spoiled inventory, but the same access could be used to:

• Destroy temperature-sensitive pharmaceuticals and vaccines (HIPAA and patient-safety implications)
• Create food safety incidents that trigger regulatory liability
• Hold physical operations hostage as extortion leverage ("pay or we cook your cold chain")
• Pivot from an OT gateway into the corporate network, where segmentation is weak

Retailers traditionally treat refrigeration controllers as facilities equipment, not as attack surface. That assumption is now indefensible.

Technical Analysis

Affected Systems

Based on reporting, the targeted devices are Danfoss system managers — centralized controllers that supervise all refrigeration and freezer assets within a store. In European retail deployments, this role is typically filled by the Danfoss AK-SM 800 series system manager, which aggregates case controllers and pack controllers, exposes a web-based management interface, and supports remote connectivity for authorized maintenance providers. The precise model distribution across the affected chains has not been publicly confirmed, and no CVE or specific firmware vulnerability has been disclosed.

How the Attack Works (Defender's View of the Kill Chain)

While the full technical details of the intrusion have not been released, the attack chain consistent with the public reporting looks like this:

1. Reconnaissance / Access acquisition. The attackers obtained access to the remote management channel used to administer the Danfoss controllers. In these architectures, the realistic paths are: (a) an internet-exposed management interface on the store's system manager, (b) compromised credentials or infrastructure belonging to a third-party refrigeration maintenance firm that has standing remote access to many stores, or (c) abuse of a vendor remote-access service. The fact that hundreds of stores across multiple retail chains were hit in a single night strongly suggests a centralized access point — i.e., a maintenance provider's remote management infrastructure or a shared service — rather than hundreds of individual store compromises.
2. Authentication to the system manager. Using legitimate administrative access, the attackers logged into the store-level controller. From a detection standpoint, this looks like a valid login — which is precisely why credential and session telemetry matters more than signature-based detection here.
3. Setpoint manipulation. The attackers raised temperature setpoints on refrigerated cases and freezers, driving compartment temperatures up to approximately 50°C. This is a pure OT integrity attack — no malware on endpoints, no lateral movement in IT — just abuse of legitimate control functionality.
4. Timing and synchronization. The operation occurred at night (October 11), when stores were closed, on-site staff absent, and — critically — when alarm response processes are weakest. Synchronized action across hundreds of sites indicates scripted or centrally orchestrated execution.

Exploitation Status

• Confirmed active, in-the-wild exploitation with physical-world destruction across multiple French retail chains.
• No CVE assigned as of this writing; the attack vector appears to be abuse of remote management access rather than a software vulnerability.
• Not currently listed in CISA KEV (no CVE exists to list).
• This is emphatically not theoretical. It is a demonstrated, repeatable attack pattern against a device class deployed globally in retail, cold storage, and healthcare.

Detection & Response

The core detection challenge: the attacker used legitimate access paths and legitimate control functions. Your detections must therefore focus on context anomalies — who is connecting, from where, at what time, and what changed — rather than malware signatures. The highest-fidelity signals for this threat class are:

• Remote access tooling or sessions reaching OT gateway/jump hosts that shouldn't have them
• After-hours interactive sessions against OT management interfaces
• Setpoint/configuration changes on controllers outside approved change windows
• New accounts, services, or persistence on the Windows or Linux gateway that fronts the OT network

Below are rules and hunts tuned to those signals. As always: tune host scoping (e.g., dedicated OT gateway hostnames/IP ranges) to your environment before deployment.

---
title: Unauthorized Remote Access Tool Execution on OT or BMS Gateway Hosts
id: 3f8c1a92-6e47-4b5d-9c10-2a7f4e8b1d56
status: experimental
description: Detects execution of remote access/RMM tooling on hosts that front operational technology (refrigeration controllers, BMS gateways). This attack pattern matches the French supermarket incident where attackers used remote administration channels to hijack Danfoss refrigeration controllers. Scope the filter_hosts field to your OT gateway/BMS jump host naming convention.
references:
  - https://thehackernews.com/2026/10/attackers-heat-french-supermarket.html
  - https://attack.mitre.org/techniques/T1219/
author: Security Arsenal
date: 2026/10/13
tags:
  - attack.command_and_control
  - attack.t1219
logsource:
  category: process_creation
  product: windows
detection:
  selection_rmm:
    Image|endswith:
      - '\anydesk.exe'
      - '\teamviewer.exe'
      - '\teamviewer_service.exe'
      - '\screenconnect.client.exe'
      - '\screenconnect.windowsclient.exe'
      - '\rustdesk.exe'
      - '\splashtop.exe'
      - '\sr_service.exe'
      - '\aeroadmin.exe'
      - '\ammyy.exe'
      - '\ngrok.exe'
      - '\zohoassist.exe'
      - '\dwagent.exe'
      - '\goservice.exe'
  filter_known_hosts:
    Computer|contains:
      - 'WS-'       # workstation prefixes to exclude
      - 'LAPTOP-'
  condition: selection_rmm and not filter_known_hosts
falsepositives:
  - Approved RMM platform used by the facilities/refrigeration maintenance vendor - allowlist the sanctioned tool and its installation path explicitly
level: high
---
title: Persistence or Account Manipulation on OT Gateway Hosts
id: 91d2e6b4-3c85-4f1a-b720-8e5c9a2d4f67
status: experimental
description: Detects creation of new local user accounts or installation of new services on OT/BMS gateway hosts, consistent with an attacker establishing durable access to a refrigeration/building management management plane after initial intrusion.
references:
  - https://thehackernews.com/2026/10/attackers-heat-french-supermarket.html
  - https://attack.mitre.org/techniques/T1136/001/
  - https://attack.mitre.org/techniques/T1543/003/
author: Security Arsenal
date: 2026/10/13
tags:
  - attack.persistence
  - attack.t1136.001
  - attack.t1543.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_net_user:
    Image|endswith: '\net.exe'
    CommandLine|contains|all:
      - 'user'
      - '/add'
  selection_net1:
    Image|endswith: '\net1.exe'
    CommandLine|contains|all:
      - 'user'
      - '/add'
  selection_sc:
    Image|endswith: '\sc.exe'
    CommandLine|contains:
      - 'create'
  filter_admin_hosts:
    Computer|contains:
      - 'WS-'
      - 'LAPTOP-'
  condition: (selection_net_user or selection_net1 or selection_sc) and not filter_admin_hosts
falsepositives:
  - Maintenance vendor service accounts created during authorized work - correlate against change tickets and maintenance windows
level: high

// Hunt: After-hours or unusual remote sessions and configuration changes against OT controller management interfaces.
// Ingest Danfoss system manager / OT firewall / VPN logs into Sentinel via Syslog or CEF.
// Set OtControllerSubnet to your refrigeration/BMS controller range and tune the maintenance window.
let OtControllerSubnet = "10.90.0.0/16";   // <-- replace with your OT controller segment
let NightStart = 20;                          // 8 PM local - attack occurred at night
let NightEnd = 6;                             // 6 AM local
union isfuzzy=true
(
    CommonSecurityLog
    | where ipv4_is_in_range(DestinationIP, OtControllerSubnet)
    | where DestinationPort in (80, 443, 502, 8080, 8443, 22, 3389)  // web mgmt, Modbus, SSH, RDP to OT
    | where hourofdatetime(TimeGenerated) >= NightStart or hourofdatetime(TimeGenerated) < NightEnd
    | project TimeGenerated, SourceIP, DestinationIP, DestinationPort, Protocol, DeviceAction, Message
),
(
    Syslog
    | where ipv4_is_in_range(HostIP, OtControllerSubnet) or SyslogMessage has_any ("setpoint", "set-point", "configuration changed", "user login", "session established")
    | where hourofdatetime(TimeGenerated) >= NightStart or hourofdatetime(TimeGenerated) < NightEnd
    | project TimeGenerated, Computer, HostIP, Facility, SeverityLevel, SyslogMessage
)
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by SourceIP, DestinationIP, DestinationPort
| sort by EventCount desc;

-- Hunt artifact: OT Gateway Remote Access and Persistence Triage
-- Run against Windows gateway/jump hosts that front the refrigeration/BMS network.
-- Looks for RMM tooling processes and established external connections.

LET rmm_regex = '(?i)(anydesk|teamviewer|screenconnect|rustdesk|splashtop|aeroadmin|ammyy|ngrok|zohoassist|dwagent)'

SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Exe =~ rmm_regex
   OR CommandLine =~ rmm_regex
   OR CommandLine =~ '(?i)net(1)?\.exe.*user.*\/add'
   OR CommandLine =~ '(?i)sc\.exe.*create'

-- Also review active connections from these hosts for unexpected external peers
LET suspicious_pids = SELECT Pid FROM pslist() WHERE Exe =~ rmm_regex

SELECT Pid, Name, Status, Family, Type,
       Laddr.IP AS LocalIP, Laddr.Port AS LocalPort,
       Raddr.IP AS RemoteIP, Raddr.Port AS RemotePort
FROM netstat()
WHERE Status = 'ESTABLISHED'
  AND NOT Raddr.IP =~ '^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.)'

#!/bin/bash
# ot-gateway-audit.sh - Audit and harden a Linux gateway/jump host fronting OT controllers
# (refrigeration system managers, BMS). Run as root. Review before executing in production.

set -euo pipefail
REPORT="/var/log/ot-gateway-audit-$(date +%Y%m%d-%H%M%S).log"
exec > >(tee -a "$REPORT") 2>&1

OT_SUBNET="10.90.0.0/16"          # <-- set to your controller segment
MGMT_ALLOWED_SRC="203.0.113.0/24" # <-- set to your maintenance vendor / NOC source range ONLY

echo "=== [1] Unauthorized RMM / tunneling tools ==="
for t in anydesk teamviewer rustdesk ngrok frp chisel ligolo socat ammyy; do
  if command -v "$t" >/dev/null 2>&1 || pgrep -f "$t" >/dev/null 2>&1; then
    echo "[!] FOUND: $t present or running"
  fi
done

echo "=== [2] Listening services exposed beyond loopback ==="
ss -tulnp | awk 'NR>1 {print $1, $5, $7}' | grep -v '127.0.0.1' || true

echo "=== [3] Recent authentication activity (off-hours review) ==="
last -F | head -n 40
journalctl _COMM=sshd --since "7 days ago" | grep -Ei 'accepted|failed' | tail -n 50 || true

echo "=== [4] Recently created/modified local accounts ==="
awk -F: '$3 >= 1000 {print $1, $3, $6}' /etc/passwd
find /etc/cron* /var/spool/cron -type f -mtime -14 -ls 2>/dev/null || true

echo "=== [5] Firewall: restrict OT management plane to approved sources ==="
# Only allow management traffic to the OT segment from the approved maintenance/NOC range.
iptables -C OUTPUT -d "$OT_SUBNET" -s "$MGMT_ALLOWED_SRC" -j ACCEPT 2>/dev/null || \
  iptables -I OUTPUT -d "$OT_SUBNET" -s "$MGMT_ALLOWED_SRC" -p tcp -m multiport --dports 80,443,22 -j ACCEPT
# Default-deny everything else toward the OT management plane.
iptables -C OUTPUT -d "$OT_SUBNET" -j DROP 2>/dev/null || \
  iptables -A OUTPUT -d "$OT_SUBNET" -j DROP
echo "[+] Egress to $OT_SUBNET restricted to $MGMT_ALLOWED_SRC (save rules per your distro)"

echo "=== [6] Disable unused remote services ==="
for svc in telnet vsftpd xrdp vncserver; do
  if systemctl is-enabled "$svc" >/dev/null 2>&1; then
    systemctl disable --now "$svc" && echo "[+] Disabled $svc"
  fi
done

echo "=== Audit complete. Report: $REPORT ==="

Remediation and Hardening

Because no CVE or vendor patch is associated with this campaign, remediation is architectural and procedural. These are the actions that would have broken this attack chain:

Immediate (this week):

1. Inventory every Danfoss system manager (AK-SM or equivalent) and refrigeration controller in your estate. You cannot protect what facilities manages invisibly. Pull the list from your maintenance vendor and reconcile it against your network inventory.
2. Remove direct internet exposure. No refrigeration controller or system manager management interface should be reachable from the public internet — full stop. Scan your external footprint (and have your vendor attest to theirs) for exposed management ports. Place all management access behind a VPN or, preferably, a ZTNA broker with MFA and device posture checks.
3. Force credential rotation on all controller management accounts, vendor remote access accounts, and any shared maintenance credentials. Eliminate shared accounts; enforce unique per-technician identities so session attribution is possible.
4. Enforce MFA on every remote path into OT. Password-only vendor access to a control plane is how incidents like this scale from one store to hundreds.
5. Alert on setpoint changes. Work with your facilities/vendor teams to generate alerts (email/SIEM) on any temperature setpoint or configuration change, especially outside approved change windows. A setpoint moving from 2°C toward 50°C is a five-alarm event, not a log line.

Short term (30 days):

6. Broker third-party maintenance access through a jump host you control. Vendor connectivity should terminate on your hardened jump server with session recording, time-boxed access grants (just-in-time, not standing), and explicit approval per session. Standing 24/7 vendor access to hundreds of stores is the exact aggregation point this campaign exploited.
7. Segment OT from IT and from the internet. Controllers on a dedicated VLAN/VRF, default-deny east-west, egress filtering so controllers cannot initiate outbound connections except to explicitly approved update/NTP endpoints.
8. Deploy the detections above scoped to your OT gateway hosts, and build an after-hours alerting profile: any interactive session or configuration change against the refrigeration management plane between store close and open pages a human.
9. Verify physical safety interlocks. Confirm that high-temperature alarms, local overrides, and case-level safety cutouts function independently of the central system manager — so a hijacked manager cannot silently defeat local protections.

Strategic:

10. Treat food-safety cold chain as critical infrastructure in your risk register, with the same IR playbooks you'd apply to ransomware: isolation procedures, vendor notification trees, regulatory obligations, and public communications. Include a controller-hijack scenario in your next tabletop exercise.
11. Contractually bind maintenance vendors to security requirements: MFA, session brokering, breach notification SLAs, and the right to audit their remote access infrastructure. In a supply-chain-style compromise like this one, your vendor's security posture is your security posture.

Monitor Danfoss security advisories and your national CSIRT (ANSSI for French operators, CISA for US operators) for any follow-up technical disclosure from this incident. If a vulnerability in the system manager is eventually published, patch windows on OT are measured in weeks — start the change-control conversation with your vendor now, not after the advisory drops.

Related Resources

Security Arsenal Healthcare Cybersecurity AlertMonitor Platform Book a SOC Assessment healthcare Intel Hub