Key takeaway
Three weeks after hundreds of French supermarkets were hit, attackers again rewrote temperature and defrost settings on refrigeration controllers in Belgium, Sweden, Estonia and elsewhere in Europe — while active exploitation of a CVSS 10.0 Siemens SIMATIC IoT2050 flaw and C3RB3R ransomware on outdated Synology NAS devices shows the same failure mode: exposed management interfaces that nobody patches, monitors, or inventories.
What happened
Overnight into Monday, November 2, attackers remotely changed the settings on refrigeration controls at supermarkets in Belgium, Sweden, Estonia and several other European countries, warming fridges and freezers. At Delhaize, refrigeration contractor Sabcobel saw cooling units switched into defrost mode — meant to clear ice, but in these cases it heated the cabinets instead of keeping food cold, CEO Stephan Moelans told Belgian media. At an ICA store in Sjöbo, southern Sweden, fridges and freezers were set to 50°C and staff threw out affected goods. At a Selver store in Estonia, an older Danfoss controller was set to 50°C, though the temperature rose only 2–3°C and the issue was resolved in about ten minutes with no product damage, according to supplier Kitman Coldtech. No one had claimed the attacks as of Monday night, and it was not known whether they were linked to the October campaign against French supermarkets. Danfoss said its products were involved in both waves.
Reported scope
Company statements compiled by The Hacker News put affected stores in at least nine countries: Delhaize (several dozen stores in Belgium plus a few in Luxembourg), Carrefour Belgium (15 of more than 700), Intermarché Belgium (10–15), Spar/Colruyt (5), a single IKEA store in Mons, ICA and Coop in Sweden (6–7 of about 800 for Coop), Musgrave/SuperValu in Ireland (13 of 223), at least 17 Dutch businesses including butchers and small shops, a few smaller Kesko stores in Finland, 7 Intermarché stores in Portugal and at least 4 Sicilian Coop stores. A butcher in Hove, near Antwerp, saw fridges raised to 18°C and estimated about €15,000 of meat ruined; Musgrave pulled chilled and frozen products from sale as a precaution. The access paths described by the vendors are mundane. Danfoss told Dutch broadcaster NOS that the affected Dutch systems were not on a secure network and still used default passwords. It told VTM that the weakness lies mainly in outdated software. Sabcobel said attackers reached individual supermarkets' systems, not the contractor's, and that roughly 20 units were affected among the hundreds it manages in Belgium. In October, Danfoss said most units hit in France were end-of-life AK-SM 800 and AK-SC 355 models it no longer updates.
Two more exposed interfaces
On the same day, VulnCheck reported active exploitation of CVE-2026-58115 (CVSS 10.0), a missing-authentication flaw in the Node-RED HTTP interface on Siemens SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed. Siemens fixed it in version 4.3.4.1; as of October 30, VulnCheck saw attempts against its honeypots that deployed a Node-RED flow, fetched an AMD64 botnet binary from 85.215.73[.]250 via wget (curl as fallback), saved it as /dev/shm/.b and executed it. Later samples pulled wget.sh or a payload saved as /tmp/.kworker from 45.194.90[.]57:38472. Other requests deployed no downloader at all: an HTTP-in endpoint wired to an exec node, giving a backdoor that survives reboot. Separately, Synology urged DSM users to update after observing ransomware attacks against devices running outdated versions, pointing to a November 2024 advisory covering CVE-2024-10441 (9.8) among others. Customers report C3RB3R ransomware dropping a .L0CK3D extension and read-me3.txt notes, skipping 27 directories and extensions such as BAT, DLL, EXE and SYS to keep encrypting. Qihoo 360 noted C3RB3R also exploited two DSM flaws patched in September 2026.
Why it matters
These are not exotic intrusions. They are configuration writes and unauthenticated HTTP requests against devices that were plugged in years ago, handed to a contractor, and forgotten. For European defenders the refrigeration campaign is the first widely reported case of deliberate, low-sophistication cyber-physical impact at retail scale — food loss, store closures, regulator attention — achieved without malware, exploits, or a ransom note. CERT-FR's alert CERTFR-2026-ALE-012 covers Danfoss AK-SM/AK-SC controllers plus Copeland xweb and Dixell xweb, and warns that campaigns against these devices are probably still ongoing; when checked on November 3 it had last been updated on October 16, and Danfoss had published no advisory on the attacks.
Detection angle
Your telemetry probably breaks in three places. First, most refrigeration and building controllers have no meaningful authentication or configuration-change log; a defrost-schedule edit looks identical to a legitimate service action. Second, the change arrives from the vendor's remote-monitoring path, so it may appear in firewall logs as approved contractor traffic rather than as an intrusion. Third, edge appliances like Node-RED gateways often sit outside EDR coverage entirely, leaving only DNS, proxy, and NetFlow records — which is exactly where the downloader behaviour is visible.
What defenders should do
Validate coverage
Inventory first: enumerate internet-reachable management interfaces for refrigeration controllers, IoT gateways, NAS and email/ADC appliances, then check for default credentials and EOL models. Map the activity to ATT&CK for ICS T0836 (Modify Parameter) and T0855 (Unauthorized Command Message), and to enterprise T1190 (Exploit Public-Facing Application), T1059.004, T1105 and T1486. Concrete sources to replay against: firewall/NetFlow for inbound sessions to controller and Node-RED ports from outside expected contractor ranges; BMS/SCADA setpoint and defrost-mode change events, alerting on 50°C-style maxima and defrost-to-heat transitions; Linux process telemetry for execution from /dev/shm, /tmp and dot-prefixed binaries named like kernel threads (/tmp/.kworker); proxy and DNS logs for the Node-RED downloader chain; file-integrity events for NAS shares with bulk renames to .L0CK3D and creation of read-me3.txt; and appliance auth logs for admin-interface access from non-internal networks on Barracuda gear, where CVE-2026-116606 plus CVE-2026-111560 chain to root.
Exercise in the lab
Run the Node-RED path end to end: stand up an IoT2050-equivalent Node-RED instance, replay the HTTP-in → function → exec flow with a /cmd-style query parameter, and confirm your pipeline fires on the child-process spawn and the outbound fetch rather than on the initial HTTP request — the request itself looks like ordinary editor traffic. Then simulate the retail case with a Modbus/setpoint replay: change a defrost schedule to heat mode on a lab controller and verify whether anything other than a human notices. Finally, detonate a C3RB3R-like encryption pattern against a lab NAS share and measure how long your file-integrity rule takes to alert versus the share's own write volume baseline.
Sources
- The Hacker News — New Wave of Refrigeration Cyberattacks Hits Supermarkets Across Europe, Forcing Stores to Pull Food
- BleepingComputer — Hackers disrupt refrigeration systems at European supermarkets
- CERT-FR — Alerte CERTFR-2026-ALE-012 (refrigeration controllers)
- The Hacker News — Attackers Exploit Critical Siemens IoT2050 Flaw to Plant Remote Command Backdoors
- VulnCheck — Exploitation targeting Node-RED
- Siemens ProductCERT — SSA-834709
- The Hacker News — Synology NAS Devices Targeted in Ransomware Attacks Exploiting Patched DSM Flaw
- BleepingComputer — Synology warns of C3RB3R ransomware attacks targeting NAS devices
- The Hacker News — Barracuda Flaws Could Be Chained to Bypass Authorization and Gain Root Access
- Barracuda Trust Center — Pre-authentication authorization bypass and command injection