FBI & CISA Warn of Attacks on Cold Chain Monitoring Systems — ICS Defense and Detection Guide

The FBI and CISA have issued a joint cybersecurity warning to critical infrastructure organizations regarding active cyberattacks targeting refrigeration and cold chain monitoring systems. This is not a theoretical advisory. The targeting of temperature control and cold storage monitoring infrastructure represents a direct threat to food safety, pharmaceutical integrity, vaccine storage, and healthcare supply chains — sectors where a manipulated temperature setpoint or a disabled alarm can destroy millions of dollars in product, trigger regulatory action under FDA and USDA rules, and in the worst cases put patient safety at risk.

Cold chain systems sit in a dangerous blind spot for most security programs. They are operational technology (OT) assets — programmable logic controllers (PLCs), remote terminal units, and human-machine interfaces (HMIs) — that speak industrial protocols like Modbus, BACnet, and EtherNet/IP. They were engineered for reliability and uptime, not security. Many ship with default credentials, lack authentication on control functions, and are increasingly reachable from the internet through vendor remote-access portals, misconfigured firewalls, or direct exposure that shows up on Shodan within minutes of a misconfiguration. When the FBI and CISA jointly warn a sector, it means exploitation is confirmed and defenders need to move now.

This post breaks down the threat from a defender's perspective: what these attacks look like on the wire and on the host, how to hunt for compromise of your cold chain assets today, and the specific hardening steps that will matter most.

Technical Analysis

What's being targeted

Refrigeration and cold chain monitoring environments typically consist of:

• Rack controllers and unit controllers managing compressor groups, condensers, and evaporators (common vendors in this space include Emerson/Copeland, Danfoss, Carel, and Heatcraft)
• Site supervisory controllers and building management system (BMS) gateways aggregating dozens to hundreds of stores, warehouses, or distribution centers
• HMI panels and web-based monitoring dashboards used by facilities teams and third-party refrigeration contractors
• Cellular and VPN remote access gateways installed by vendors for maintenance

These systems communicate over protocols that have no native authentication or encryption: Modbus TCP (port 502), BACnet/IP (UDP 47808), EtherNet/IP (44818), and in some deployments Siemens S7 (102) or proprietary serial protocols tunneled over TCP. Any host that can reach these ports can read coil temperatures, door states, and defrost cycles — and can write setpoints, silence alarms, and change defrost schedules.

Attack chain

The joint warning describes activity consistent with the attack pattern we have repeatedly observed against exposed OT in the food and agriculture sector:

1. Discovery: Adversaries scan the internet for exposed ICS services using Shodan, Censys, or direct scanning of port 502/47808. Site supervisory controllers and BMS gateways with web interfaces are trivially fingerprintable.
2. Initial access: Exploitation of default or weak credentials on HMI web interfaces, or unauthenticated direct protocol access to Modbus/BACnet services. In several public incidents against critical infrastructure HMIs, no exploit was needed at all — the device answered.
3. Manipulation: Write commands to holding registers to alter temperature setpoints, alarm thresholds, and defrost cycles. On BACnet, WriteProperty against alarm and setpoint objects. On Modbus, function codes 6 (Write Single Register) and 16 (Write Multiple Registers).
4. Persistence and staging: Where the attacker lands on a Windows-based HMI or supervisory server rather than an embedded controller, we see standard IT tradecraft — new local accounts, RDP enablement, web shells on the vendor portal, and scheduled tasks — used to maintain access across reboots and patch cycles.

The impact scenarios are severe: slow spoilage of food and pharmaceutical inventory through subtle setpoint drift (harder to detect than a shutdown), mass defrost events across a retail chain, falsified temperature logs that create regulatory exposure, and ransomware detonation on the supervisory Windows hosts that run the monitoring software.

Exploitation status

This advisory is driven by observed, active malicious activity, not hypothetical risk. The FBI/CISA joint warning model is reserved for threats with confirmed targeting. Organizations in food production, grocery retail, cold storage logistics, pharmaceutical distribution, and healthcare (blood banks, vaccine and biologics storage) should treat themselves as in-scope today.

Detection & Response

The detections below target the highest-fidelity observable behaviors: unexpected hosts talking to ICS protocols, manipulation-capable protocol functions crossing network boundaries, and IT-side persistence on the Windows hosts that run supervisory and HMI software.

Sigma Rules

---
title: Unexpected Host Connecting to ICS Protocol Ports
description: Detects network connections from non-baselined workstations to industrial control protocol ports (Modbus 502, BACnet 47808, EtherNet/IP 44818, S7 102). Cold chain and refrigeration controllers should only receive connections from known supervisory hosts and engineering workstations.
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort:
      - 502
      - 102
      - 47808
      - 44818
  filter_known_supervisory:
    DestinationIp:
      - '10.10.20.15'  # Replace with your known supervisory/HMI host IPs
  condition: selection and not filter_known_supervisory
falsepositives:
  - Legitimate engineering workstation access during maintenance windows — baseline and suppress known hosts
level: high
---
title: HMI or SCADA Supervisory Process Spawning Command Shell
description: Detects common HMI/SCADA supervisory software or vendor remote access services spawning cmd.exe, powershell.exe, or other script interpreters. Refrigeration monitoring applications have no legitimate reason to launch shells; this is a strong indicator of post-exploitation on the supervisory host.
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\svchost.exe'
    ParentCommandLine|contains:
      - 'RemoteAccess'
      - 'VNC'
      - 'TeamViewer'
      - 'ScreenConnect'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\rundll32.exe'
  condition: all of selection_*
falsepositives:
  - Vendor remote support sessions — require change tickets for any remote access tool usage
level: high
---
title: Local Account Creation on HMI or Supervisory Host
description: Detects creation of new local user accounts on hosts running HMI, BMS, or refrigeration supervisory software. Cold chain supervisory servers should have a static, documented account list; new accounts indicate persistence staging.
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - 'net user'
      - 'net localgroup administrators'
      - 'New-LocalUser'
      - 'Add-LocalGroupMember'
  filter_legit:
    User|contains:
      - 'SVC_SCCM'
      - 'SVC_Automation'
  condition: selection and not filter_legit
falsepositives:
  - Managed account provisioning via configuration management — baseline service accounts
level: medium

KQL — Microsoft Sentinel / Defender

This hunt looks for externally sourced or laterally sourced traffic to ICS protocol ports in your environment, using firewall/NDR logs ingested into CommonSecurityLog, plus Defender process telemetry for shells under remote access tools. Tune the destination IP range to your OT segments.

// Hunt 1: Inbound or lateral connections to ICS/cold chain protocol ports
let ICS_Ports = dynamic([502, 47808, 44818, 102]);
let OT_Segments = dynamic(["10.30.", "10.31.", "192.168.50."]); // Adjust to your OT VLANs
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where DestinationPort in (ICS_Ports)
| where DestinationIP has_any (OT_Segments)
| extend IsExternal = ipv4_is_private(SourceIP) == false
| summarize Connections = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated),
            SourceIPs = make_set(SourceIP), Devices = make_set(DeviceAction)
  by DestinationIP, DestinationPort, IsExternal
| where IsExternal == true or Connections > 50
| sort by IsExternal desc, LastSeen desc;

// Hunt 2: Shells spawned by remote access tools on supervisory hosts
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName has_any ("teamviewer", "screenconnect", "vnc", "anydesk", "rutserv", "romserver")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "net.exe", "net1.exe")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName
| sort by TimeGenerated desc;

// Hunt 3: New account creation events on OT-adjacent servers
SecurityEvent
| where TimeGenerated > ago(7d)
| where EventID == 4720  // User account created
| where Computer has_any ("HMI", "BMS", "SCADA", "REFRIG", "SUPERVISOR") // Adjust to naming convention
| project TimeGenerated, Computer, TargetUserName, SubjectUserName, IpAddress
| sort by TimeGenerated desc;

Velociraptor VQL

Deploy this artifact against supervisory and HMI hosts to enumerate live connections to ICS ports, identify which processes own them, and surface unexpected listeners that may indicate attacker-deployed tunnels.

-- Hunt: ICS protocol connections and unexpected listeners on supervisory hosts
SELECT Pid, Name, Path, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status, Family, Type
FROM netstat()
WHERE (RemotePort in (502, 47808, 44818, 102)
    OR LocalPort in (502, 47808, 44818, 102, 3389, 5985))
   AND Status =~ 'ESTABLISHED|LISTEN'
ORDER BY LocalPort

-- Hunt: Recently created local accounts and suspicious run-key persistence
SELECT Name AS KeyName, {SELECT Data FROM stat(path=FullPath)} AS Data
FROM glob(globs='HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\*',
          accessor='registry')
WHERE KeyName =~ 'update|service|agent|remote'

Hardening / Audit Script

Run this PowerShell on Windows-based HMI and supervisory hosts to audit exposure: ICS-related listeners, RDP state, local administrators, and remote access tools that should not be present.

# Cold chain supervisory host exposure audit - run elevated
Write-Host "=== ICS/Remote listeners ===" -ForegroundColor Cyan
Get-NetTCPConnection -State Listen | Where-Object {
  $_.LocalPort -in 102,502,3389,47808,44818,5985,5900,5800
} | Select-Object LocalAddress, LocalPort, OwningProcess,
  @{N='Process';E={(Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName}} | Format-Table -AutoSize

Write-Host "=== RDP status ===" -ForegroundColor Cyan
$rdp = Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections
if ($rdp.fDenyTSConnections -eq 0) { Write-Warning "RDP ENABLED - disable on OT supervisory hosts unless strictly required" } else { Write-Host "RDP disabled (good)" }

Write-Host "=== Local administrators ===" -ForegroundColor Cyan
Get-LocalGroupMember -Group 'Administrators' | Select-Object Name, ObjectClass, PrincipalSource | Format-Table -AutoSize

Write-Host "=== Unauthorized remote access tools ===" -ForegroundColor Cyan
$bad = 'teamviewer','anydesk','screenconnect','vnc','rustdesk','ammyy','splashtop'
Get-CimInstance Win32_Product -ErrorAction SilentlyContinue | Where-Object {
  $n=$_.Name.ToLower(); $bad | Where-Object { $n -match $_ }
} | Select-Object Name, Vendor, InstallDate | Format-Table -AutoSize
Get-Process | Where-Object { $p=$_.ProcessName.ToLower(); $bad | Where-Object { $p -match $_ } } |
  Select-Object ProcessName, Id, Path | Format-Table -AutoSize

Write-Host "=== Firewall rules allowing ICS ports inbound ===" -ForegroundColor Cyan
Get-NetFirewallRule -Direction Inbound -Action Allow -Enabled True |
  Get-NetFirewallPortFilter | Where-Object { $_.LocalPort -in '102','502','47808','44818' } |
  Select-Object DisplayName, LocalPort, Protocol | Format-Table -AutoSize

Remediation

Prioritize in this order. The first three items can be completed within 48 hours and address the exact access paths described in the advisory.

1. Remove internet exposure immediately. Audit your public IP space against Shodan and Censys for ports 502, 47808, 44818, 102, 8080, and 443 answering on OT assets. No refrigeration controller, BMS gateway, or HMI should be directly internet-reachable. Vendor maintenance access must ride a hardened jump host with MFA — not a cellular modem hanging off the controller.
2. Change every default and shared credential. Inventory all HMI web interfaces, supervisory controllers, and remote access gateways. Default vendor credentials are the number-one initial access vector in these campaigns. Rotate contractor/shared accounts and move to per-user accountability.
3. Block ICS protocols at zone boundaries. Firewall rules should deny Modbus, BACnet, EtherNet/IP, and S7 traffic between the corporate network and OT VLANs except from explicitly documented supervisory hosts. Log all permitted flows.
4. Segment per IEC 62443 zones and conduits. Refrigeration controllers, supervisory servers, and corporate IT belong in separate zones with a monitored conduit (ideally an industrial DMZ) between them. A compromised corporate workstation must not be one hop away from writing a setpoint.
5. Deploy OT-aware monitoring. Passively monitor ICS protocol traffic (Claroty, Nozomi, Dragos, or even Zeek with the ICSNPP Modbus/BACnet analyzers) and alert on write function codes (Modbus FC 5/6/15/16, BACnet WriteProperty) from any non-baselined source. Write commands are rare in steady-state operations — this is a high-fidelity alert.
6. Harden the Windows supervisory layer. These are the hosts attackers pivot to for persistence: disable RDP or gate it behind MFA-enabled brokered access, remove unauthorized remote access tools, apply current OS and vendor application patches, deploy EDR, and enable the Sigma detections above.
7. Lock down safety and alarm integrity. Configure out-of-range alarm thresholds at the controller level, enable audit logging on setpoint changes, and establish an out-of-band verification process (physical or independent sensor) so a falsified dashboard cannot mask real temperature excursions. For FDA-regulated cold chain, verify your temperature data loggers operate independently of the networked monitoring system.
8. Tabletop the scenario. Walk your IR team through: setpoint manipulation discovered at 2 a.m. across 40 stores. Who can isolate the supervisory network? Who calls the vendor? Who assesses product disposition? The joint advisory is your justification to run this exercise now.

Report suspected compromise to CISA (report@cisa.gov or 888-282-0870) and your local FBI field office. Both agencies specifically requested reporting on this activity — your incident data directly informs sector-wide defense.

Related Resources

Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub