[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f2w8oBexoPD_JtgmChjuDYW6a0ZUbOY7THQQoHT2N4II":3},{"article":4,"iocs":48,"watch_terms":49,"solutions":50,"lesson":142},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"b973ec91-ac1b-4710-8389-833b75f6c974","Turning Up the Heat: Inside the Attacks on Europe’s Refrigeration System","turning-up-the-heat-inside-the-attacks-on-europe-s-refrigeration-system-680490","Unit 42 examines recent cyberattacks targeting European refrigeration systems and outlines defense and mitigation strategies. The post Turning Up the Heat: Inside the Attacks on Europe’s Refrigeration System appeared first on Unit 42.","Unit 42 is tracking cyberattacks against European refrigeration systems, where threat actors set controllers to defrost mode, leading to spoiled food in hundreds of supermarkets and impacting medical facilities. While initial access vectors are unconfirmed, vulnerable software and default credentials are suspected. Pro-Russian hacktivist groups NoName057(16) and Z-Pentest have claimed responsibility, though this remains unverified.","Cyberattacks target European refrigeration systems, causing food spoilage and fires.","https:\u002F\u002Funit42.paloaltonetworks.com\u002Feuropes-refrigeration-systems-attacks\u002F","https:\u002F\u002Funit42.paloaltonetworks.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002F06_Myth-Busting_Category_1505x922.jpg","2026-11-06T21:15:09+00:00","2026-11-06T22:00:02.820302+00:00",7,[17,20,22],{"name":18,"type":19},"NoName057(16)","threat_actor",{"name":21,"type":19},"Z-Pentest",{"name":23,"type":24},"Cortex Xpanse","product","d6f63bb8-0801-486a-be7f-171400700454",{"id":25,"icon":27,"name":28,"slug":29},null,"IoT\u002FOT","iot-ot",[31,36,41,43],{"category":32},{"id":33,"icon":27,"name":34,"slug":35},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":37},{"id":38,"icon":27,"name":39,"slug":40},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":42},{"id":25,"icon":27,"name":28,"slug":29},{"category":44},{"id":45,"icon":27,"name":46,"slug":47},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[23],{"controls":51,"vendors":135},[52,81,106],{"slug":53,"name":54,"problem":55,"products":56},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[57,65,73],{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":61,"product_name":62,"url":63,"description":64},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":82,"name":83,"problem":84,"products":85},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[86,93,98],{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":88,"url":91,"description":92},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":94,"product_name":95,"url":96,"description":97},"axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"slug":107,"name":108,"problem":109,"products":110},"ot-security","OT and industrial control system security","Factory, building and utility control systems get visibility and protection.",[111,119,127],{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"claroty","Claroty","\u002Fvendor-logos\u002Fclaroty.png","xdome","Claroty xDome","https:\u002F\u002Fclaroty.com\u002Findustrial-cybersecurity\u002Fxdome","Asset inventory, vulnerability management and threat detection for industrial networks.",{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"nozomi-networks","Nozomi Networks","\u002Fvendor-logos\u002Fnozomi-networks.png","guardian","Nozomi Networks Guardian","https:\u002F\u002Fwww.nozominetworks.com\u002Fplatform\u002Fguardian","Passive monitoring, asset inventory and threat detection for OT and IoT networks.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-ot-security","Tenable OT Security","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fot-security","Asset inventory, vulnerability and threat detection for industrial networks.",[136],{"slug":137,"name":138,"logo_path":139,"roles":140},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png",[141],"reported_by",{"slug":143,"title":144,"body":145,"framework_refs":146,"framework_notes":154},"default-credentials-and-vulnerable-ot-software-leave-european-refrigeration-systems-open-to-sabotage","Default Credentials and Vulnerable OT Software Leave European Refrigeration Systems Open to Sabotage","Threat actors — likely pro-Russian hacktivist groups — exploited suspected default credentials and unpatched software to gain control of industrial refrigeration controllers across European supermarkets and medical facilities, switching them to defrost mode and causing widespread food spoilage and potential harm to temperature-sensitive medical supplies. This attack highlights a chronic failure in operational technology (OT) security: internet-exposed industrial control systems are routinely left with factory-default passwords and unpatched firmware, making them trivial targets. The consequences extend well beyond IT disruption — compromised OT systems can directly harm public health and critical supply chains. As hacktivists increasingly target physical infrastructure to cause visible societal impact, the security baseline for OT environments must rise significantly.",[147,148,149,150,151,152,153],"CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 7: Continuous Vulnerability Management","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIS2 Article 21(2)(b)","NIST SP 800-53 SI-2: Flaw Remediation","MITRE ATT&CK T1078: Valid Accounts",{"NIS2 Article 21(2)(b)":155,"MITRE ATT&CK T1078: Valid Accounts":156,"NIST SP 800-53 SI-2: Flaw Remediation":157,"CIS Control 7: Continuous Vulnerability Management":158,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":159,"CIS Control 4: Secure Configuration of Enterprise Assets and Software":160,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":161},"European supermarket refrigeration and medical facility supply chains fall under NIS2 scope for essential and important entities; Article 21(2)(b) requires incident handling and security measures proportionate to the risk, including securing OT systems against exactly this type of sabotage.","Attackers likely leveraged default or compromised credentials to authenticate as legitimate users of the refrigeration controllers; T1078 specifically covers adversary use of valid accounts to gain initial access, underscoring the need to eliminate default credentials in OT environments.","SI-2 requires organisations to identify, report, and correct information system flaws within defined timeframes; applying this control to the refrigeration management software would have closed the vulnerability before attackers could exploit it.","Vulnerable software on the refrigeration controllers was a likely attack vector; CIS Control 7 mandates continuous scanning and timely remediation of vulnerabilities across all networked assets, including industrial control systems.","Unpatched and vulnerable software on internet-exposed controllers enabled this attack; A.8.8 requires timely identification and remediation of technical vulnerabilities, which would have reduced the exploitable attack surface.","The suspected use of default credentials is a classic misconfiguration; CIS Control 4 requires organisations to establish and enforce secure baseline configurations — including changing default passwords — on all assets, including OT controllers, before deployment.","Default credentials provided attackers with the access needed to change controller settings; this framework function requires organisations to manage identities and enforce strong authentication, directly preventing unauthorised access to critical OT systems."]