The French government has officially attributed an October cyberattack to a cyber unit of Iran's Islamic Revolutionary Guard Corps (IRGC), marking a dangerous escalation in state-sponsored sabotage against civilian retail infrastructure. On the night of October 11, attackers gained unauthorized access to refrigeration controllers at approximately 700 retail sites across France, manipulating defrost settings to high temperatures.
The impact was immediate and physical: widespread food spoilage across retail locations and, in at least 15 confirmed cases, actual fires ignited by the manipulated equipment. This is not a data breach or a ransomware event — this is kinetic cyberwarfare targeting the physical safety of civilians and the operational continuity of the French food supply chain.
For defenders in retail, logistics, food and beverage, and any sector relying on industrial control systems (ICS) or operational technology (OT), this attack is a wake-up call. If your organization deploys networked refrigeration controllers, HVAC systems, or any Internet-accessible building management systems (BMS), you are a potential target for nation-state sabotage. The barrier to entry for these attacks is often shockingly low — default credentials, unpatched embedded firmware, or poorly segmented networks.
This analysis will break down what we know about the attack chain, how to hunt for signs of compromise in your ICS/OT environment, and the concrete steps you must take now to harden your infrastructure against similar sabotage attempts.
Technical Analysis
Attack Chain Overview
Based on the reporting from French authorities, the attack followed a relatively straightforward — but highly effective — path:
-
Initial Access: Attackers gained unauthorized access to networked refrigeration controllers. The specific access vector has not been publicly disclosed, but common entry points for ICS/OT sabotage include:
- Internet-facing controllers with default or weak credentials
- Exploitation of unpatched vulnerabilities in embedded web servers or management interfaces
- Compromise of vendor remote access solutions or third-party maintenance accounts
- Lateral movement from compromised corporate IT networks into inadequately segmented OT environments
-
Persistence & Reconnaissance: Once inside, the attackers likely conducted reconnaissance to understand the controller interfaces, identify which parameters could be modified, and determine the scope of accessible systems. In many ICS environments, controllers are deployed en masse with identical configurations, making it trivial to compromise hundreds of devices once the access method is established.
-
Impact: The attackers modified defrost settings to high temperatures across approximately 700 retail sites. Refrigeration controllers typically manage:
- Compressor cycles
- Defrost schedules (frequency and duration)
- Temperature setpoints
- Alarm thresholds
By setting defrost temperatures to dangerously high values, the attackers achieved two objectives:
- Food Spoilage: Prolonged defrost cycles or elevated temperatures cause frozen and refrigerated inventory to thaw, resulting in massive product losses.
- Fire Hazard: In at least 15 cases, the manipulated settings caused equipment to overheat, igniting fires. This represents a direct threat to human life and property.
Attribution
The French government has attributed this attack to a cyber unit of the Islamic Revolutionary Guard Corps (IRGC), Iran's elite military and intelligence organization. The IRGC has a well-documented history of conducting cyber operations against critical infrastructure, financial institutions, and government targets in the Middle East, Europe, and North America.
This attack aligns with known IRGC tactics:
- Willingness to cause physical damage: Unlike financially motivated cybercriminals, state actors like the IRGC prioritize strategic disruption and psychological impact.
- Targeting of civilian infrastructure: Attacks on retail refrigeration systems are designed to erode public confidence and strain government response capabilities.
- Use of relatively unsophisticated methods: ICS/OT environments are often so poorly defended that even basic techniques (default credentials, unpatched systems) are sufficient for devastating impact.
Affected Systems
While the specific make and model of the refrigeration controllers have not been publicly disclosed, this attack likely targeted one or more of the following common platforms used in European retail:
- Danfoss AK-series controllers
- Carel pCO and c.pCO controllers
- Eliwell EWPlus controllers
- Dixell XR/XW series
- Custom or white-label controllers deployed by retail chains
These systems typically communicate via:
- Modbus TCP/RTU
- BACnet/IP
- Proprietary protocols over TCP/IP
- Web-based management interfaces (HTTP/HTTPS)
Exploitation Status
- In-the-Wild Exploitation: CONFIRMED. This is not a theoretical vulnerability — this attack occurred in production environments at scale.
- Attribution: CONFIRMED. French government attribution to IRGC cyber unit.
- CISA KEV: Not applicable (no specific CVE disclosed at time of reporting).
- Proof-of-Concept: Not publicly available, but the technique (unauthorized access to ICS controllers via weak authentication) is well-documented and requires no advanced exploit development.
Detection & Response
This is a TECHNICAL THREAT involving ICS/OT sabotage, nation-state TTPs, and physical impact. The detection content below is designed to help SOC teams hunt for unauthorized access to ICS controllers, anomalous configuration changes, and indicators of compromise consistent with this attack pattern.
SIGMA Rules
The following Sigma rules target observable behaviors associated with unauthorized access to ICS/OT management interfaces and suspicious configuration changes. These rules assume you are ingesting logs from:
- Network firewalls or IDS/IPS monitoring ICS segments
- Web application firewalls (WAF) or reverse proxies fronting ICS web interfaces
- Windows Event Logs from jump boxes or engineering workstations used to manage controllers
---
title: Suspicious Authentication to ICS/OT Web Management Interface
id: 8f3e2a91-4c7b-4d5e-9f1a-3b8c6d2e7f90
status: experimental
description: Detects authentication attempts to ICS/OT web management interfaces from non-whitelisted source IPs or outside maintenance windows.
references:
- https://attack.mitre.org/techniques/T1078/
- https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/11/15
tags:
- attack.initial_access
- attack.t1078
- attack.t1190
logsource:
category: webserver
product: apache # Adjust to nginx, iis, or your WAF/proxy as needed
detection:
selection:
cs-uri-stem|contains:
- '/cgi-bin/'
- '/config'
- '/settings'
- '/admin'
- '/login'
- '/api/'
cs-method:
- 'POST'
- 'PUT'
- 'DELETE'
filter_known_ips:
c-ip|startswith:
- '10.' # Adjust to your internal management subnets
- '192.168.'
condition: selection and not filter_known_ips
falsepositives:
- Legitimate vendor remote maintenance (should be logged and approved)
- Misconfigured internal scanners
level: high
---
title: Unauthorized Modification of ICS Controller Configuration
id: 2b7d4f8a-9e3c-4a1b-8f6d-5c2e9a7f3d81
status: experimental
description: Detects attempts to modify ICS controller settings via web interfaces or API calls, particularly temperature setpoints or defrost parameters.
references:
- https://attack.mitre.org/techniques/T0855/ # Unauthorized Command Message
- https://attack.mitre.org/techniques/T0831/ # Manipulation of Control
author: Security Arsenal
date: 2026/11/15
tags:
- attack.impact
- attack.t0855
- attack.t0831
logsource:
category: webserver
product: apache # Adjust to your web server or WAF
detection:
selection:
cs-uri-query|contains:
- 'setpoint'
- 'temperature'
- 'defrost'
- 'threshold'
- 'alarm'
- 'config'
cs-method:
- 'POST'
- 'PUT'
filter_maintenance_window:
# Adjust this filter to match your approved maintenance windows
# This example excludes changes between 02:00-04:00 (typical maintenance window)
time|startswith:
- '02:'
- '03:'
condition: selection and not filter_maintenance_window
falsepositives:
- Automated building management system (BMS) adjustments
- Legitimate vendor firmware updates
level: critical
---
title: Unusual Network Connection to ICS/OT Segment from Corporate IT
id: 5a1c9e7f-3d8b-4f2a-9c6e-7d1f4a8b5c92
status: experimental
description: Detects network connections from corporate IT network segments to ICS/OT management ports, which may indicate lateral movement or unauthorized access attempts.
references:
- https://attack.mitre.org/techniques/T1021/ # Remote Services
- https://attack.mitre.org/techniques/T0867/ # Lateral Tool Transfer
author: Security Arsenal
date: 2026/11/15
tags:
- attack.lateral_movement
- attack.t1021
logsource:
category: firewall
product: fortigate # Adjust to your firewall vendor (paloalto, checkpoint, etc.)
detection:
selection:
dstport:
- 80 # HTTP
- 443 # HTTPS
- 502 # Modbus TCP
- 47808 # BACnet/IP
- 22 # SSH (for embedded Linux controllers)
- 23 # Telnet (legacy controllers)
- 5900 # VNC (remote access to HMI panels)
srczone: 'Corporate_IT' # Adjust to your zone naming
dstzone: 'ICS_OT' # Adjust to your zone naming
filter_approved_jumpbox:
srcip:
- '10.10.5.20' # Example: approved jump box IP
- '10.10.5.21' # Example: backup jump box IP
condition: selection and not filter_approved_jumpbox
falsepositives:
- IT/OT convergence projects (should be documented and approved)
- Misconfigured asset discovery scans
level: high
KQL (Microsoft Sentinel / Defender)
The following KQL queries are designed to hunt for suspicious activity in Microsoft Sentinel, assuming you are ingesting:
- CommonSecurityLog: Firewall logs (ASA, Fortinet, Palo Alto, etc.) via CEF
- Syslog: Linux-based ICS controllers or network devices
- SecurityEvent: Windows Event Logs from jump boxes or engineering workstations
- DeviceNetworkEvents: Microsoft Defender for Endpoint network telemetry
Hunt Query 1: Unauthorized Access to ICS/OT Web Interfaces
This query hunts for HTTP/HTTPS connections to ICS/OT segments from non-whitelisted IPs, focusing on common management ports.
// Hunt for suspicious web access to ICS/OT management interfaces
// Adjust the IP ranges and ports to match your environment
let ApprovedJumpBoxes = dynamic(["10.10.5.20", "10.10.5.21", "10.10.5.22"]);
let ICS_Subnets = dynamic(["10.20.0.0/16", "172.16.0.0/12"]); // Adjust to your ICS/OT subnets
let Management_Ports = dynamic([80, 443, 8080, 8443, 502, 47808]);
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where DestinationIP has_any (ICS_Subnets)
| where DestinationPort in (Management_Ports)
| where SourceIP !in (ApprovedJumpBoxes)
| where SourceIP !startswith "10.10.5" // Exclude approved management subnet
| where DeviceAction != "Deny" // Focus on allowed connections
| summarize ConnectionCount = count(),
FirstSeen = min(TimeGenerated),
LastSeen = max(TimeGenerated),
Ports = make_set(DestinationPort),
Protocols = make_set(Protocol)
by SourceIP, DestinationIP, DeviceVendor, DeviceProduct
| where ConnectionCount > 5 // Threshold: adjust based on baseline
| order by LastSeen desc
Hunt Query 2: Suspicious Configuration Changes on Windows Jump Boxes
This query looks for process execution on Windows systems (jump boxes, engineering workstations) that may indicate ICS configuration tool usage outside approved windows.
// Detect execution of ICS configuration tools outside maintenance windows
// This assumes you have Sysmon or MDE deployed on jump boxes
let ApprovedUsers = dynamic(["admin_john", "admin_jane", "svc_ics_maintenance"]);
let ICS_Config_Tools = dynamic([
"akcc55.exe", // Danfoss AK-CC55 configuration tool
"carel_1tool.exe", // Carel configuration software
"eliwell_tool.exe", // Eliwell configuration utility
"modbus_poll.exe", // Generic Modbus testing tool
"mbpoll.exe", // Command-line Modbus client
"bacnet_tool.exe" // BACnet configuration utility
]);
SecurityEvent
| where TimeGenerated > ago(7d)
| where EventID == 4688 // Process creation
| where Process has_any (ICS_Config_Tools)
| where Account !in (ApprovedUsers)
| extend HourOfDay = datetime_part("Hour", TimeGenerated)
| where HourOfDay < 2 or HourOfDay > 4 // Outside 02:00-04:00 maintenance window
| project TimeGenerated, Computer, Account, Process, CommandLine, ParentProcessName, IpAddress
| order by TimeGenerated desc
Hunt Query 3: Network Connections from Corporate IT to ICS/OT Segments
This query uses Defender for Endpoint telemetry to identify workstations making unexpected connections to ICS/OT networks.
// Detect lateral movement from corporate IT to ICS/OT segments
let ICS_Subnets = dynamic(["10.20.0.0/16", "172.16.0.0/12"]);
let Approved_Devices = dynamic(["JUMPBOX-01", "JUMPBOX-02", "ENG-WKS-05"]);
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemoteIP has_any (ICS_Subnets)
| where DeviceName !in (Approved_Devices)
| where RemotePort in (80, 443, 502, 47808, 22, 23, 3389, 5900)
| summarize ConnectionCount = count(),
FirstSeen = min(TimeGenerated),
LastSeen = max(TimeGenerated),
UniquePorts = dcount(RemotePort),
Processes = make_set(InitiatingProcessFileName)
by DeviceName, RemoteIP, InitiatingProcessFileName, InitiatingProcessAccountName
| where ConnectionCount > 3
| order by LastSeen desc
Velociraptor VQL
The following VQL artifact can be deployed on Windows jump boxes or engineering workstations to hunt for signs of ICS configuration tool execution, suspicious network connections, and recently modified configuration files.
-- Hunt for ICS/OT compromise indicators on Windows jump boxes
-- Deploy this artifact on systems used to manage refrigeration controllers
LET ics_tools = ("akcc55", "carel", "eliwell", "dixell", "modbus", "bacnet")
-- Check for suspicious processes related to ICS management
LET processes = SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)(akcc55|carel|eliwell|dixell|modbus|bacnet|1tool)'
OR CommandLine =~ '(?i)(akcc55|carel|eliwell|dixell|modbus|bacnet)'
-- Check for network connections to ICS subnets
LET network = SELECT Pid, Name, LocalAddr, LocalPort, RemoteAddr, RemotePort, Status
FROM netstat()
WHERE RemoteAddr =~ '^(10\\.20\\.|172\\.(16|17|18|19|20|21|22|23|24|25|26|27|28|29|30|31)\\.)'
AND RemotePort IN (80, 443, 502, 47808, 22, 23)
-- Look for recently modified ICS configuration files
LET config_files = SELECT FullPath, Size, Mtime, Atime, Ctime
FROM glob(globs='C:/Program Files*/**/*.cfg', accessor='ntfs')
WHERE Mtime > now() - 86400 * 7 -- Modified in last 7 days
AND FullPath =~ '(?i)(danfoss|carel|eliwell|dixell|refrigeration|hvac)'
-- Combine results
SELECT * FROM processes
UNION ALL
SELECT * FROM network
UNION ALL
SELECT * FROM config_files
Remediation Script
The following PowerShell script is designed to audit Windows jump boxes and engineering workstations for signs of compromise related to this attack. It checks for:
- Unauthorized ICS configuration tools
- Suspicious network connections to ICS subnets
- Recently modified ICS configuration files
- Disabled Windows Firewall (common in ICS environments, but a red flag)
IMPORTANT: Test this script in a lab environment before deploying to production jump boxes.
# ICS/OT Jump Box Security Audit Script
# Run with elevated privileges on Windows jump boxes managing refrigeration controllers
Write-Host "=== ICS/OT Jump Box Security Audit ===" -ForegroundColor Cyan
Write-Host "Audit Date: $(Get-Date)" -ForegroundColor Cyan
Write-Host ""
# Configuration
$ICSSubnets = @("10.20.", "172.16.", "172.17.", "172.18.") # Adjust to your ICS subnets
$SuspiciousTools = @("akcc55", "carel_1tool", "eliwell_tool", "modbus_poll", "mbpoll", "bacnet_tool")
$ApprovedUsers = @("admin_john", "admin_jane", "svc_ics_maintenance") # Adjust to your approved accounts
$MaintenanceWindowStart = 2 # 2 AM
$MaintenanceWindowEnd = 4 # 4 AM
# Check 1: Running ICS configuration tools
Write-Host "[1] Checking for running ICS configuration tools..." -ForegroundColor Yellow
$RunningTools = Get-Process | Where-Object {
$procName = $_.ProcessName
$SuspiciousTools | Where-Object { $procName -like "*$_*" }
}
if ($RunningTools) {
Write-Host " ALERT: Found running ICS tools:" -ForegroundColor Red
$RunningTools | ForEach-Object {
Write-Host " - $($_.ProcessName) (PID: $($_.Id), User: $($_.StartInfo.UserName))" -ForegroundColor Red
}
} else {
Write-Host " OK: No suspicious ICS tools currently running." -ForegroundColor Green
}
Write-Host ""
# Check 2: Network connections to ICS subnets
Write-Host "[2] Checking for active network connections to ICS subnets..." -ForegroundColor Yellow
$ICSConnections = Get-NetTCPConnection | Where-Object {
$remoteIP = $_.RemoteAddress
$ICSSubnets | Where-Object { $remoteIP -like "$_*" }
} | Where-Object { $_.State -eq "Established" }
if ($ICSConnections) {
Write-Host " INFO: Active connections to ICS subnets:" -ForegroundColor Cyan
$ICSConnections | ForEach-Object {
$proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
Write-Host " - $($_.LocalAddress):$($_.LocalPort) -> $($_.RemoteAddress):$($_.RemotePort) [Process: $($proc.ProcessName), PID: $($_.OwningProcess)]" -ForegroundColor Cyan
}
} else {
Write-Host " OK: No active connections to ICS subnets." -ForegroundColor Green
}
Write-Host ""
# Check 3: Recently modified ICS configuration files
Write-Host "[3] Checking for recently modified ICS configuration files..." -ForegroundColor Yellow
$ConfigPaths = @(
"C:\Program Files\Danfoss\*",
"C:\Program Files\Carel\*",
"C:\Program Files\Eliwell\*",
"C:\Program Files (x86)\Danfoss\*",
"C:\Program Files (x86)\Carel\*",
"C:\Program Files (x86)\Eliwell\*"
)
$RecentConfigs = Get-ChildItem -Path $ConfigPaths -Include "*.cfg","*.xml","*.ini","*.json" -Recurse -ErrorAction SilentlyContinue |
Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-7) }
if ($RecentConfigs) {
Write-Host " WARNING: Found recently modified config files (last 7 days):" -ForegroundColor Yellow
$RecentConfigs | ForEach-Object {
Write-Host " - $($_.FullName) [Modified: $($_.LastWriteTime)]" -ForegroundColor Yellow
}
} else {
Write-Host " OK: No recently modified ICS config files found." -ForegroundColor Green
}
Write-Host ""
# Check 4: Windows Firewall status
Write-Host "[4] Checking Windows Firewall status..." -ForegroundColor Yellow
$FirewallProfiles = Get-NetFirewallProfile
foreach ($profile in $FirewallProfiles) {
if ($profile.Enabled -eq $false) {
Write-Host " ALERT: Firewall profile '$($profile.Name)' is DISABLED!" -ForegroundColor Red
} else {
Write-Host " OK: Firewall profile '$($profile.Name)' is enabled." -ForegroundColor Green
}
}
Write-Host ""
# Check 5: Suspicious scheduled tasks (persistence mechanism)
Write-Host "[5] Checking for suspicious scheduled tasks..." -ForegroundColor Yellow
$SuspiciousTasks = Get-ScheduledTask | Where-Object {
$taskName = $_.TaskName
$SuspiciousTools | Where-Object { $taskName -like "*$_*" }
}
if ($SuspiciousTasks) {
Write-Host " ALERT: Found suspicious scheduled tasks:" -ForegroundColor Red
$SuspiciousTasks | ForEach-Object {
Write-Host " - $($_.TaskName) [Path: $($_.TaskPath), State: $($_.State)]" -ForegroundColor Red
}
} else {
Write-Host " OK: No suspicious scheduled tasks found." -ForegroundColor Green
}
Write-Host ""
# Check 6: Recent logon events (outside maintenance window)
Write-Host "[6] Checking for logons outside maintenance window (2-4 AM)..." -ForegroundColor Yellow
$RecentLogons = Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4624; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue |
Where-Object {
$hour = $_.TimeCreated.Hour
$user = $_.Properties[5].Value
($hour -lt $MaintenanceWindowStart -or $hour -gt $MaintenanceWindowEnd) -and
($ApprovedUsers -notcontains $user)
}
if ($RecentLogons) {
Write-Host " WARNING: Found logons outside maintenance window:" -ForegroundColor Yellow
$RecentLogons | Select-Object -First 10 | ForEach-Object {
$user = $_.Properties[5].Value
$logonType = $_.Properties[8].Value
Write-Host " - $($_.TimeCreated): User '$user' (Logon Type: $logonType)" -ForegroundColor Yellow
}
} else {
Write-Host " OK: No unexpected logons outside maintenance window." -ForegroundColor Green
}
Write-Host ""
Write-Host "=== Audit Complete ===" -ForegroundColor Cyan
Write-Host "Review any ALERT or WARNING items above and investigate further if needed." -ForegroundColor Cyan
Write-Host ""
Write-Host "Recommendations:" -ForegroundColor Cyan
Write-Host " 1. Ensure all ICS management interfaces require strong authentication (MFA preferred)." -ForegroundColor White
Write-Host " 2. Implement network segmentation: ICS/OT should be isolated from corporate IT." -ForegroundColor White
Write-Host " 3. Use jump boxes for all ICS management; disable direct access from workstations." -ForegroundColor White
Write-Host " 4. Enable comprehensive logging on ICS controllers and forward logs to SIEM." -ForegroundColor White
Write-Host " 5. Regularly audit ICS configuration files for unauthorized changes." -ForegroundColor White
Remediation
Immediate Actions (Within 24-48 Hours)
-
Inventory and Isolate ICS/OT Assets
- Conduct an immediate inventory of all refrigeration controllers, HVAC systems, and building management systems in your environment.
- Identify which controllers are directly accessible from the Internet or from corporate IT networks.
- Isolate ICS/OT segments using firewalls or VLANs. Deny all traffic by default; allow only explicitly required protocols and IP addresses.
-
Change Default Credentials
- Audit all ICS controllers for default or weak passwords. Common defaults include:
admin/adminroot/rootadmin/passworddanfoss/danfosscarel/carel
- Enforce strong, unique passwords for each controller. Use a password manager designed for ICS environments (e.g., CyberArk, Thycotic).
- Audit all ICS controllers for default or weak passwords. Common defaults include:
-
Disable Unnecessary Remote Access
- Disable Telnet, FTP, and unencrypted HTTP on all ICS controllers. Use SSH and HTTPS only.
- Disable vendor remote access accounts unless absolutely required for maintenance. If required, use time-limited accounts with MFA.
-
Enable Logging and Monitoring
- Enable authentication and configuration change logging on all ICS controllers.
- Forward logs to a centralized SIEM (Microsoft Sentinel, Splunk, etc.).
- Deploy network intrusion detection systems (NIDS) on ICS/OT segments. Use Snort/Suricata rules to detect Modbus, BACnet, and proprietary protocol anomalies.
-
Implement Jump Boxes for ICS Management
- Prohibit direct access to ICS controllers from user workstations.
- Require all ICS management to occur through hardened jump boxes with:
- Multi-factor authentication (MFA)
- Session recording
- Application whitelisting (only approved ICS tools)
- Full audit logging
Short-Term Actions (Within 1-2 Weeks)
-
Patch and Update Firmware
- Contact your refrigeration controller vendors (Danfoss, Carel, Eliwell, Dixell, etc.) to obtain the latest firmware updates.
- Apply updates during scheduled maintenance windows. Test updates in a lab environment first.
- Maintain an inventory of firmware versions across all controllers. Use this inventory to identify outdated systems.
-
Implement Network Segmentation (Purdue Model)
- Segment your network according to the Purdue Enterprise Reference Architecture:
- Level 0: Physical process (compressors, sensors)
- Level 1: Basic control (refrigeration controllers)
- Level 2: Area supervisory control (HMI panels)
- Level 3: Site operations (BMS servers, historians)
- Level 4: Corporate IT (email, ERP)
- Use firewalls to enforce strict access control between levels. Deny all traffic by default.
- Segment your network according to the Purdue Enterprise Reference Architecture:
-
Deploy ICS-Aware Network Monitoring
- Deploy ICS-specific network monitoring tools such as:
- Nozomi Networks Guardian
- Claroty CTD
- Dragos Platform
- Microsoft Defender for IoT (formerly CyberX)
- These tools provide deep packet inspection (DPI) for ICS protocols (Modbus, BACnet, DNP3, etc.) and can detect unauthorized commands or configuration changes.
- Deploy ICS-specific network monitoring tools such as:
-
Conduct Threat Hunting
- Use the Sigma, KQL, and VQL queries provided above to hunt for signs of compromise in your environment.
- Look for:
- Unauthorized access attempts to ICS controllers
- Configuration changes outside maintenance windows
- Unusual network traffic patterns (e.g., corporate IT to ICS/OT)
- Execution of ICS configuration tools by unauthorized users
Long-Term Actions (Ongoing)
-
Develop an ICS/OT Incident Response Plan
- Create a dedicated incident response plan for ICS/OT environments. This plan should include:
- Procedures for isolating compromised controllers
- Steps for reverting to known-good configurations
- Contact information for ICS vendors and law enforcement
- Procedures for forensic data collection from ICS devices
- Conduct tabletop exercises to test your ICS/OT IR plan.
- Create a dedicated incident response plan for ICS/OT environments. This plan should include:
-
Implement Configuration Management
- Use configuration management tools (e.g., Tripwire, OSSEC) to monitor ICS controller configurations for unauthorized changes.
- Maintain a baseline of approved configurations for each controller type.
- Alert on any deviation from the baseline.
-
Conduct Regular Security Assessments
- Perform annual penetration tests of your ICS/OT environment. Use firms with ICS/OT expertise (not just IT pen testers).
- Conduct regular vulnerability scans using ICS-aware tools (e.g., Tenable.ot, Nessus with ICS plugins).
- Participate in information sharing organizations such as:
- E-ISAC (Electricity Information Sharing and Analysis Center)
- FS-ISAC (Financial Services ISAC)
- Retail & Hospitality ISAC
-
Train Staff on ICS/OT Security
- Provide specialized ICS/OT security training for IT and OT staff. Recommended certifications:
- GICSP (GIAC Global Industrial Cyber Security Professional)
- GRID (GIAC Response and Industrial Defense)
- ISA/IEC 62443 Cybersecurity Certificate Programs
- Conduct regular awareness training on phishing, social engineering, and physical security.
- Provide specialized ICS/OT security training for IT and OT staff. Recommended certifications:
-
Engage with Government and Law Enforcement
- If you suspect nation-state activity, contact your national cybersecurity agency:
- France: ANSSI (Agence nationale de la sécurité des systèmes d'information)
- United States: CISA (Cybersecurity and Infrastructure Security Agency)
- United Kingdom: NCSC (National Cyber Security Centre)
- Report incidents to law enforcement (FBI, Europol, etc.) as required by your jurisdiction.
- If you suspect nation-state activity, contact your national cybersecurity agency:
Vendor-Specific Guidance
While the specific controller vendors involved in this attack have not been publicly disclosed, the following general guidance applies to common refrigeration controller platforms:
- Danfoss: Refer to Danfoss Security Advisories at https://www.danfoss.com/en/service-and-support/downloads/dcs/security/
- Carel: Refer to Carel Product Security at https://www.carel.com/security
- Eliwell (Schneider Electric): Refer to Schneider Electric Security Notifications at https://www.se.com/ww/en/work/support/cybersecurity/security-notifications.jsp
- Dixell (Emerson): Refer to Emerson Product Security at https://www.emerson.com/en-us/automation/product-security
CISA and Government Advisories
- CISA ICS Advisories: Monitor https://www.cisa.gov/news-events/cybersecurity-advisories for ICS-specific advisories.
- CISA Known Exploited Vulnerabilities (KEV): Monitor https://www.cisa.gov/known-exploited-vulnerabilities-catalog for actively exploited vulnerabilities.
- ANSSI (France): Monitor https://www.cert.ssi.gouv.fr/ for French-language advisories.
Conclusion
The IRGC's sabotage of refrigeration controllers at 700 French retail sites is a stark reminder that nation-state actors are willing and able to cause physical damage through cyber means. This attack did not require advanced zero-day exploits or sophisticated malware — it likely exploited basic security failures: weak credentials, unpatched systems, and inadequate network segmentation.
For defenders, the lesson is clear: ICS/OT security is not optional. If your organization relies on networked industrial control systems — whether refrigeration controllers, HVAC systems, PLCs, or SCADA networks — you must treat them as high-value targets and defend them accordingly.
The detection rules, hunting queries, and remediation steps provided in this analysis are designed to help you identify and respond to similar attacks in your environment. But detection alone is not enough. You must also implement strong preventive controls: network segmentation, strong authentication, regular patching, and comprehensive monitoring.
The physical world and the cyber world are now inextricably linked. Defend accordingly.
Related Resources
Security Arsenal Alert Triage Automation AlertMonitor Platform Book a SOC Assessment platform Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.