Science & Tech · Cybersecurity · 3 hrs ago
Exposed supermarket refrigeration controllers used for spam and proxy traffic
SecurityScorecard found exposed refrigeration controllers being misused to send spam and route internet traffic.
The devices are Copeland XWEB PRO units, used to monitor and control supermarket and cold-storage freezers and chillers.
Three controllers sent coordinated spam, with 508 of 1,041 email targets contacted by at least two of them.
Two other controllers were used to route traffic: one in Namibia acted as a tunnel gateway, while one in Trinidad and Tobago behaved like a proxy.
Researchers suspect attackers exploited a login flaw that could let someone access a controller without a password.
These internet-connected devices may lack security updates and monitoring, making misuse harder to detect.
SecurityScorecard has not linked this activity to European store attacks, and its investigation into who controlled the devices is ongoing.
SecurityScorecard found internet-exposed supermarket refrigeration controllers being used to send spam and route proxy traffic.
The controllers are Copeland XWEB PRO units, originally made by Dixell, that let technicians monitor and adjust refrigeration systems remotely.
Three controllers were linked to coordinated spam activity, while two others were used for proxy or tunnel traffic.
SecurityScorecard said attackers most likely exploited a vulnerability that can bypass the controller’s password prompt.
The company has not linked these findings to attacks on refrigeration systems in France or elsewhere in Europe.
- Who
- SecurityScorecard identified the activity. The affected devices are refrigeration controllers used at commercial sites.
- What
- Exposed controllers were hijacked to send spam and route proxy traffic.
- When
- Nine IP addresses were first spotted on November 2. The report was published on November 9, 2026.
- Where
- The devices were connected to networks in Namibia and Trinidad and Tobago, among other locations.
- Why
- SecurityScorecard believes attackers most likely used CVE-2026-25085, which can let an unauthenticated user bypass the login prompt.
This story does not have two clearly opposing sides.
Hundreds of French supermarkets reportedly had stock spoiled after attackers switched refrigeration systems to heating.
Another wave of attacks hit stores in Belgium, Luxembourg and Sweden; later reports added Finland, Ireland, Estonia and the Netherlands.
SecurityScorecard first spotted nine IP addresses with unusual outgoing email activity.
Help Net Security published SecurityScorecard’s findings.
- Controller model
- Copeland XWEB PRO, originally made by Dixell
- Spam-linked controllers
- 3 of the 9 unusual IP addresses were confirmed as XWEB controllers
- Email targets
- 1,041 targets; 508 were contacted by two or more nodes
- Namibia controller
- Carried 71% of traffic in the captured data
- Trinidad and Tobago controller
- Connected to 10,643 hosts in 17 hours
- Suspected vulnerability
- CVE-2026-25085
What people are saying
Independent spammers would not converge on the same victims by chance
STRIKE’s overall confidence is low to medium.
When taking action, treat these IPs as victims or abused infrastructure, not as adversary-owned assets