Attackers are going after the controllers that keep supermarket freezers and cold storage rooms at the right temperature, and five US agencies want those devices taken off the open internet. In a joint fact sheet published on 5 November, CISA, the FBI, the Department of Health and Human Services, the Department of Agriculture and the Department of Transportation say they are aware of malicious cyber activity targeting industrial refrigeration and cold chain monitoring systems globally.
The agencies describe actors targeting electronic temperature controllers and commercial refrigeration controllers in retail grocery and cold storage facilities. By exploiting unpatched or internet-accessible controllers, they can remotely change settings and force units into continuous heating and defrost cycles. The fact sheet warns that this can cause widespread inventory loss and equipment hazards.
Spoiled stock is only the first risk
The same systems handle temperature logging, defrost management and remote monitoring across healthcare, chemical, food and agriculture, and transportation, including refrigerated transport. That is why health and agriculture agencies signed the warning: food or medical supplies stored at the wrong temperature become a public health problem, not just a write-off. The agencies list the possible effects of a changed temperature as a shorter equipment life, a fire hazard, lost inventory, and indirect harm to consumers who eat products after unsafe storage. Attackers can also cause a denial-of-view condition, where operators lose sight of current temperatures altogether.
The fact sheet names three routes in, authentication bypass, arbitrary code injection and weak configurations, but does not name affected manufacturers, specific vulnerabilities or a threat actor. It joins a run of warnings about small, overlooked operational technology at the network edge, from fuel terminal controllers with an open root port to the CyberAv3ngers attacks on Unitronics PLCs.
Take controllers off the internet and cap the setpoints
The agencies ask owners and operators to act immediately on the following:
- Remove public internet exposure for controller panels, and put any remote access that is truly needed behind an updated firewall or edge device.
- Put OT devices on a dedicated VLAN, separate from business networks.
- Change default passwords, enforce strong ones, and use phishing-resistant multifactor authentication where feasible.
- Keep firmware current and retire end-of-life controllers the manufacturer no longer supports.
- Allowlist the devices and IP addresses permitted to make changes.
- Keep tested offline backups, enable logging, and capture network traffic where devices cannot log.
- Define reasonable setpoint limits for equipment downstream of the controllers and alert on any deviation.
US organizations can report suspicious activity to CISA's 24/7 Operations Center or the FBI's IC3. The last item on the list may matter most in practice: a system that refuses an unsafe setpoint, and raises an alarm when someone tries, limits the damage an intruder can do no matter whose password they are holding.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.