Hackers abuse refrigeration controllers to send spam and route proxy traffic
Hackers exploit internet-connected refrigeration controllers for spam botnets and proxy services.
Internet-exposed refrigeration controllers, specifically Copeland XWEB PRO units, are being hijacked to operate spam botnets and proxy services. SecurityScorecard's analysis identified controllers sending outgoing email without receiving any, indicating malicious activity. The attackers likely exploit a vulnerability, CVE-2026-25085, allowing unauthenticated access to these devices, which often lack security updates.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Dixell?
Get an email when a new story names Dixell, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonInternet-facing industrial refrigeration controllers (Copeland XWEB PRO) were compromised due to an unauthenticated access vulnerability (CVE-2026-25085), allowing attackers to co-opt the devices into spam botnets and proxy networks. The root problem is a combination of unpatched firmware and misconfigured devices left directly exposed to the internet with no access controls enforced. Operational Technology (OT) and IoT devices are frequently overlooked in vulnerability management programs, creating long-lived, easy-to-exploit footholds. This matters because compromised infrastructure devices can be weaponized at scale while remaining invisible to defenders who focus exclusively on traditional IT assets.
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- External attack surface management (EASM)
You find your forgotten internet-facing systems before attackers do.
- Automated patch management
Known holes get closed in days, not months.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-25085