Same Failure Mode, Three Victims: Internet-Exposed OT, Unpatched Firmware, and a Ransomware Crew

Over the first week of November, attackers warmed freezers in at least a dozen European retail chains using nothing more exotic than default passwords and internet-facing controllers — while separate crews exploited a maximum-severity Siemens flaw and a two-year-old Synology patch gap. Supermarket refrigeration, round two. Overnight into Monday, 2 November, attackers remotely changed settings on refrigeration controls at supermarkets in Belgium, Sweden, Estonia and elsewhere, warming fridges and freezers. No chain reported more than several dozen affected stores, but several had to discard or pull chilled and frozen food. The mechanics were consistent. In Belgium, units were switched into defrost mode — normally used to clear ice — so they heated instead of cooling, according to Stephan Moelans, CEO of refrigeration contractor Sabcobel, which manages systems for Delhaize. Elsewhere the setpoint was simply raised: an ICA store in Sjöbo, southern Sweden, had fridges and freezers set to 50°C and staff were throwing out goods; a Selver store in Estonia saw a freezer set to 50°C, though its temperature rose only 2–3°C and the issue was resolved in about ten minutes with no product loss. A butcher shop in Hove, south of Antwerp, had fridges pushed to 18°C, with the owner estimating roughly €15,000 of meat ruined. Reported victims span Belgium and Luxembourg (Delhaize, Carrefour — 15 of more than 700 stores, Intermarché, Spar under Colruyt Group, one IKEA in Mons), Sweden (ICA, Coop), Ireland (Musgrave's SuperValu, 13 of 223 stores), the Netherlands (at least 17 businesses, per Danfoss), Finland (Kesko), Portugal (Intermarché, 7) and Italy (Coop stores in Sicily). Danfoss confirmed its products were involved, as they were three weeks earlier when attackers hit hundreds of French supermarkets on the night of 11 October. The root causes are unglamorous. A Danfoss spokesperson told Dutch broadcaster NOS that the affected Dutch systems were not on a secure network and still used default passwords; the company told Belgian broadcaster VTM that the weakness lies mainly in outdated software, and that customers who had not updated were the ones hit. In France, most units struck were models Danfoss no longer updates — the AK-SM 800, end-of-life since May 2021, and the AK-SC 355, phased out in 2016 — though some current AK-SM 800A units running outdated firmware were also affected. Claroty had already reported finding thousands of AK-SM 800A management interfaces reachable from the internet. No one had claimed the November attacks, and it is not established that the same actors were behind the French and multi-country waves; a shared method does not prove shared authorship. Siemens IoT2050 under active exploitation. VulnCheck reported exploitation of CVE-2026-58115 (CVSS 10.0), a missing-authentication flaw in the Node-RED HTTP interface on SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed. Siemens' August 2026 advisory warned an unauthenticated remote attacker could create malicious flows and execute code with maximum privileges; it is fixed in 4.3.4.1 and later. As of 30 October, VulnCheck's honeypot recorded requests that deployed a Node-RED flow, triggered it automatically, and pulled an AMD64 botnet binary from 85.215.73[.]250 via wget (curl as fallback), saving and executing it as /dev/shm/.b. Later requests used a two-stage wget.sh and a .sys_update payload cached as /tmp/.kworker from 45.194.90[.]57:38472. Notably, some flows shipped no downloader at all: they exposed an HTTP-in endpoint wired to an exec node, letting the attacker run commands later via a query parameter — a backdoor that survives a reboot. C3RB3R ransomware on Synology NAS. Synology urged customers to update DiskStation Manager after observing ransomware attacks against outdated DSM versions, exploiting a vulnerability patched in December 2024. The vendor did not name the exact flaw but linked its November 2024 advisory covering CVE-2024-10441 (CVSS 9.8, RCE in the system plugin daemon), CVE-2024-50629 and CVE-2024-10445. Customers have reported C3RB3R encrypting files with a .L0CK3D extension and dropping read-me3.txt. Qihoo 360 notes C3RB3R's history against NAS devices, including exploitation of CVE-2026-13684 and CVE-2026-13639, patched in September 2026. C3RB3R skips 27 directories and extensions such as BAT, DLL, EXE, LNK, MSI and SYS to avoid crashing the host mid-encryption.

These are not three unrelated incidents; they are the same control failure observed at three price points. In each case the attacker needed no zero-day, no credential phishing and no supply-chain compromise — only a device that terminates its management interface somewhere the internet can reach, running software the owner has stopped tracking. For European practitioners the retail case deserves particular attention. Refrigeration controllers are OT in the mundane sense: not a power grid, but cold-chain infrastructure whose failure produces immediate financial and food-safety consequences. Sabcobel's Moelans said a software update alone is not enough because installations need physical changes that cost money, and that the simplest answer is a secure internet connection for managing the fridges. That is a budget conversation, not a patch. CERT-FR's alert — still the most detailed public guidance and last updated 16 October — covers Danfoss AK-SM/AK-SC series alongside Copeland xweb and Dixell xweb, and warns that end-of-life devices left on the internet are very likely to be compromised, with a factory reset alone leaving them open to re-attack. The Siemens and Synology cases add the detection-side lesson: a device that is patched is not the same as a device that is remediated. An IoT2050 with a live exec-node flow looks like a normal Node-RED installation from inventory. A NAS that was never upgraded since before December 2024 looks like normal storage until the .L0CK3D files appear.

Inventory and de-expose OT. Enumerate every refrigeration, HVAC and building controller with a routable address. CERT-FR's order of operations: make devices unreachable from the internet (check insurance contracts before cutting contractor data feeds), audit the full configuration including defrost schedules, then restore access only through a VPN or protected network. Filtering contractor IPs at the firewall is an emergency measure, not a fix. On Danfoss hardware, set the security level to Strict and rotate default passwords; for compromised units, restart or factory reset and fully reconfigure before returning to service. Hunt for Node-RED abuse on IoT2050. Alert on newly created or modified Node-RED flows containing exec nodes or HTTP-in endpoints, especially paths like /cmd or random strings. Watch for wget/curl spawning from the Node-RED process, and for binaries written to /dev/shm, /tmp/.kworker, or other dot-prefixed paths masquerading as system processes. Block and retro-hunt on 85.215.73[.]250 and 45.194.90[.]57. Where Node-RED is not operationally required, remove it; otherwise enforce HTTPS, credential or OAuth-based auth on the editor and admin API, and basic auth on HTTP nodes and dashboards, then upgrade to 4.3.4.1 or later. Close the DSM gap. Verify the exact DSM build against Synology's fixed versions for each branch (7.2.2-72806-1, 7.2.1-69057-6, 7.2-64570-4, 7.1.1-42962-7, 6.2.4-25556-8 and above), enable automatic updates, and take NAS management interfaces off the internet. Ensure off-device, offline backups exist — C3RB3R targets the storage holding the only copy of the data. Fix the process, not just the boxes. The recurring variable across all three stories is ownership: contractor-managed controllers, integrator-installed gateways and home-office NAS units that no one's vulnerability management programme covers. Put them in the asset register with an end-of-life date and a named owner, and treat EOL internet-facing devices as incidents rather than findings.