[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fDCVp6qSjp3erANCfV6AuTM41Xo4Jqea0p0zwdMHMxvE":3},{"article":4,"iocs":50,"watch_terms":55,"solutions":56,"lesson":144},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"6d9a2d5b-7ce7-432e-9c29-fb07a09d5e59","Hackers abuse refrigeration controllers to send spam and route proxy traffic","hackers-abuse-refrigeration-controllers-to-send-spam-and-route-proxy-traffic-a2d706","Internet-exposed refrigeration controllers used in supermarkets and cold storage facilities are being hijacked and turned into infrastructure for a suspected spam botnet and proxy services, SecurityScorecard has found. The report follows a string of attacks against European refrigeration systems, which Help Net Security started covering in October, when hundreds of French supermarkets had to throw out spoiled stock after attackers took over the systems running their fridges and freezers overnight and switched them to heating. … More → The post Hackers abuse refrigeration controllers to send spam and route proxy traffic appeared first on Help Net Security.","Internet-exposed refrigeration controllers, specifically Copeland XWEB PRO units, are being hijacked to operate spam botnets and proxy services. SecurityScorecard's analysis identified controllers sending outgoing email without receiving any, indicating malicious activity. The attackers likely exploit a vulnerability, CVE-2026-25085, allowing unauthenticated access to these devices, which often lack security updates.","Hackers exploit internet-connected refrigeration controllers for spam botnets and proxy services.","https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F11\u002F09\u002Fcopeland-xweb-refrigeration-controllers-spam-botnet\u002F","https:\u002F\u002Fimg.helpnetsecurity.com\u002Fwp-content\u002Fuploads\u002F2026\u002F10\u002F12180608\u002Fhand-laptop-warm-1500.webp","2026-11-09T14:54:01+00:00","2026-11-09T15:00:02.63034+00:00",7,[17,20,23,25,27,29],{"name":18,"type":19},"Copeland XWEB PRO","product",{"name":21,"type":22},"Dixell","vendor",{"name":24,"type":22},"Copeland",{"name":26,"type":22},"Danfoss",{"name":28,"type":19},"XWEB",{"name":30,"type":31},"TLS","technology","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":32,"icon":34,"name":35,"slug":36},null,"Malware","malware",[38,40,45],{"category":39},{"id":32,"icon":34,"name":35,"slug":36},{"category":41},{"id":42,"icon":34,"name":43,"slug":44},"d6f63bb8-0801-486a-be7f-171400700454","IoT\u002FOT","iot-ot",{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[51],{"type":52,"value":53,"context":54},"cve","CVE-2026-25085","Vulnerability in controller's login check exploited by attackers",[21,24,26],{"controls":57,"vendors":137},[58,87,109],{"slug":59,"name":60,"problem":61,"products":62},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[63,71,79],{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":88,"name":89,"problem":90,"products":91},"attack-surface-management","External attack surface management (EASM)","You find your forgotten internet-facing systems before attackers do.",[92,100,108],{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"outpost24","Outpost24","\u002Fvendor-logos\u002Foutpost24.png","outpost24-easm","Outpost24 EASM","https:\u002F\u002Foutpost24.com\u002Fproducts\u002Fexternal-attack-surface-management\u002F","Discovery and risk assessment of internet-facing assets.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"detectify","Detectify","\u002Fvendor-logos\u002Fdetectify.png","surface-monitoring","Detectify Surface Monitoring","https:\u002F\u002Fdetectify.com\u002Fproduct\u002Fsurface-monitoring","Continuous discovery and testing of internet-facing subdomains and services.",{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},{"slug":110,"name":111,"problem":112,"products":113},"patch-management","Automated patch management","Known holes get closed in days, not months.",[114,121,129],{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":110,"product_name":118,"url":119,"description":120},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",[138],{"slug":139,"name":140,"logo_path":141,"roles":142},"securityscorecard","SecurityScorecard","\u002Fvendor-logos\u002Fsecurityscorecard.png",[143],"reported_by",{"slug":145,"title":146,"body":147,"framework_refs":148,"framework_notes":156},"exposed-refrigeration-controllers-hijacked-for-spam-and-proxy-botnets","Exposed Refrigeration Controllers Hijacked for Spam and Proxy Botnets","Internet-facing industrial refrigeration controllers (Copeland XWEB PRO) were compromised due to an unauthenticated access vulnerability (CVE-2026-25085), allowing attackers to co-opt the devices into spam botnets and proxy networks. The root problem is a combination of unpatched firmware and misconfigured devices left directly exposed to the internet with no access controls enforced. Operational Technology (OT) and IoT devices are frequently overlooked in vulnerability management programs, creating long-lived, easy-to-exploit footholds. This matters because compromised infrastructure devices can be weaponized at scale while remaining invisible to defenders who focus exclusively on traditional IT assets.",[149,150,151,152,153,154,155],"CIS Control 7: Continuous Vulnerability Management","CIS Control 1: Inventory and Control of Enterprise Assets","NIST SP 800-53 SI-2: Flaw Remediation","OWASP A06:2021 Vulnerable and Outdated Components","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":157,"NIST SP 800-53 SI-2: Flaw Remediation":158,"OWASP A06:2021 Vulnerable and Outdated Components":159,"CIS Control 7: Continuous Vulnerability Management":160,"CIS Control 1: Inventory and Control of Enterprise Assets":161,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":162,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":163},"NIS2 mandates incident handling and security measures proportionate to risk for operators of essential services; leaving critical infrastructure controllers internet-exposed and unpatched violates this obligation.","SI-2 requires organizations to identify, report, and correct information system flaws on a defined schedule — timely remediation of CVE-2026-25085 would have closed the unauthenticated access vector.","The controllers ran firmware containing a known, unpatched vulnerability, directly matching the OWASP risk of deploying components with unaddressed security flaws.","Regular authenticated scanning of all networked assets — including OT\u002FIoT devices — would have flagged CVE-2026-25085 and triggered patching before attackers could exploit unauthenticated access.","Refrigeration controllers being internet-exposed without detection suggests they were absent from asset inventories; a complete, maintained inventory is the prerequisite for protecting every device.","This control requires timely identification and remediation of technical vulnerabilities in all assets; applying it to OT devices would have ensured the Copeland firmware flaw was patched promptly.","The exploit succeeded because the controllers permitted unauthenticated access; enforcing authentication on all management interfaces is exactly what this CSF outcome requires."]