Exposed Danfoss Controller Reconnaissance and Exploitation

Source

---
analysis: A standing detection rule might flag known IPs, but this hunt baselines
  external IP behavior to Danfoss endpoints and pivots to inventory and public exposure
  data to identify targeted synchronization attempts that might rotate IPs.
blind_spots:
- id: limited-visibility-into-unmanaged-networks
  question: whether all Danfoss controllers in the estate are reporting inventory
  requires: hb_software_inventory coverage for all OT segments
  risk: Unmanaged or shadow OT assets will not be scoped, leaving them vulnerable
    to undetected exploitation.
- id: missing-http-post-bodies
  question: whether reconnaissance parameters were passed in the HTTP POST body
  requires: hb_http_activity with request body capture
  risk: The hunt primarily analyzes URL paths and queries; if parameters like read_units
    are in the body, the activity will be missed.
  stage: recon-and-info-theft
coverage:
- stage: recon-and-info-theft
  status: covered
  steps:
  - http-recon-sync-activity
  - external-ip-prevalence
  - exposed-asset-check
- stage: exploit-synchronization
  status: covered
  steps:
  - http-recon-sync-activity
- reason: 'Belongs to another part of the ''The Cold Chain on Fire : Unpatched Danfoss
    controllers exploited'' series.'
  stage: brute-force-spraying
  status: out_of_scope
- reason: 'Belongs to another part of the ''The Cold Chain on Fire : Unpatched Danfoss
    controllers exploited'' series.'
  stage: unauthenticated-account-takeover
  status: out_of_scope
- reason: 'Belongs to another part of the ''The Cold Chain on Fire : Unpatched Danfoss
    controllers exploited'' series.'
  stage: parameter-sabotage
  status: out_of_scope
guardrails:
  claims: no_unsupported
  evidence: citation_required
  missing_data: not_benign
  telemetry: untrusted
hunt:
  applicability: campaign-specific
  handoff: keep-as-periodic-hunt
  justification: Recent attacks on Danfoss controllers have led to significant financial
    losses due to food spoilage and safety risks. Confirming the absence of exploit
    synchronization activity is critical for refrigeration integrity.
  methodology: model-assisted
  trigger: intel-report
hypothesis: An attacker is enumerating internet-exposed Danfoss controllers and synchronizing
  system time to bypass authentication via the CVE-2025-41450 vulnerability.
labels:
- hunt
- attack.t1190
- attack.t1041
- credential access
- impact
- initial access
name: Exposed Danfoss Controller Reconnaissance and Exploitation
parameters:
  attacker_ips:
    default:
    - 178.83.226.215
    - 37.16.75.128
    description: Observed attacker IP addresses from recent campaigns.
    from:
      kind: article
      observed: '2026-11-09'
      ref: sekoia
    type: list[ip]
  lookback_days:
    default: '14'
    description: Days of history to examine.
    type: number
  scope_hosts:
    default: []
    description: Optional list of specific Danfoss hostnames to focus the search.
    type: list[host]
  target_endpoint:
    default: /xml.cgi
    description: The specific CGI endpoint targeted by the reconnaissance and exploit
      chain.
    type: string
provenance:
  authors:
  - name: Huntbase hunt generation
    org: huntbase.io
  generated:
    by: huntbase-hunt-generation
    from: https://www.sekoia.com/blog/the-cold-chain-on-fire-unpatched-danfoss-controllers-exploited
    gates:
    - dry-run
    - lint
    - critic
    model: hb_google/gemini-3-flash-preview
rationale: Initial focus is on all devices identified as Danfoss controllers in the
  software inventory. This includes systems likely residing on OT or building management
  subnets.
references:
- name: "Sekoia \u2014 The Cold Chain on Fire: Unpatched Danfoss controllers exploited"
  url: https://www.sekoia.com/blog/the-cold-chain-on-fire-unpatched-danfoss-controllers-exploited
related:
- hunt: ics-default-credential-spraying
  reason: This hunt focuses on the xml.cgi vulnerability chain; general password spraying
    against default credentials is covered by a separate sibling hunt.
  relation: out-of-scope-alternative
scenario:
  stages:
  - name: Controller Enumeration and Information Theft
    observables:
    - xml.cgi
    - read_units action
    - retrieval of store identity and location from controller configuration
    slug: recon-and-info-theft
    tactic: initial-access
    techniques:
    - T1190
    - T1041
  - name: Bypass Synchronization via Time Check
    observables:
    - read_date_time action
    - xml.cgi
    - CVE-2025-41450
    slug: exploit-synchronization
    tactic: initial-access
    techniques:
    - T1190
  - name: Credential Spraying of Default Accounts
    observables:
    - Supervisor account
    - admin account
    - password "12345"
    - xml.cgi
    slug: brute-force-spraying
    tactic: credential-access
    techniques:
    - T1555
  - name: Unauthorized User Account Takeover
    observables:
    - unauthenticated renaming of user ID 1
    - unauthenticated password reset requests
    - IP 178.83.226.215
    - IP 37.16.75.128
    slug: unauthenticated-account-takeover
    tactic: credential-access
    techniques:
    - T1555
  - name: Malicious Modification of Control Parameters
    observables:
    - temperature modification from 50 to 80C
    - temperature reprogrammed to 110C
    - modified defrost cycles
    - modified alarm thresholds
    slug: parameter-sabotage
    tactic: impact
    techniques:
    - T1190
  summary: Threat actors exploited unpatched, internet-exposed Danfoss refrigeration
    controllers to sabotage temperature and defrost settings, causing significant
    operational disruption and food spoilage across European supermarket chains. The
    campaign utilized unauthenticated vulnerabilities, such as CVE-2025-41450 and
    an account-renaming exploit, to bypass authentication and gain administrative
    control over the controllers.
series:
  index: 1
  slug: the-cold-chain-on-fire-unpatched-danfoss-controllers-exploited
  title: 'The Cold Chain on Fire : Unpatched Danfoss controllers exploited'
  total: 2
severity: high
targets:
  analyst:
    name: Tier-2 analyst
    role: analyst
  endpoint:
    category: endpoint
    name: Endpoint telemetry (hb_ surfaces)
    telemetry:
    - endpoint
  hunter:
    agent: true
    name: Hunt agent
  web:
    category: siem
    name: Web server / proxy logs
    telemetry:
    - network
tlp: clear
type: investigation
---


# Exposed Danfoss Controller Reconnaissance and Exploitation

This hunt identifies Danfoss refrigeration controllers in the environment and monitors for unauthenticated HTTP requests targeting the xml.cgi endpoint. It specifically searches for 'read_units' actions used for reconnaissance and 'read_date_time' actions required to synchronize an exploit with the controller's internal clock for authentication bypass. An agent correlates these suspicious traffic patterns with known attacker infrastructure and external exposure data to identify targeted exploitation attempts.

## scoping-danfoss-inventory
<!-- Identify Danfoss Controllers in Inventory -->
Find every device reporting Danfoss software or firmware to narrow the hunt's focus.

```sqlite target=endpoint role=scoping
~~~yaml
expected: A list of hosts likely representing Danfoss controller hardware. Silence
  indicates no Danfoss assets are managed or inventoried.
reads:
- device_hostname
- package_name
- package_version
- vendor_name
silence: not_evidence_of_absence
source: hb_software_inventory
verified: dry-run
verified_at: '2026-11-10'
~~~
SELECT device_hostname, package_name, package_version, vendor_name FROM hb_software_inventory WHERE LOWER(package_name) LIKE '%danfoss%' OR LOWER(vendor_name) LIKE '%danfoss%'
```

## investigation-parallel
<!-- Investigate Activity and Prevalence -->
parallel:
- → http-recon-sync-activity
- → external-ip-prevalence
- → exposed-asset-check
join: → triage-agent

## http-recon-sync-activity
<!-- Detect Recon and Synchronization HTTP Requests -->
Match specific actions used to enumerate units or read system time for exploit synchronization.

```sqlite target=web role=detection-candidate params=(scope_hosts=scope_hosts, target_endpoint=target_endpoint, attacker_ips=attacker_ips, lookback_days=lookback_days)
~~~yaml
expected: Requests from external IPs attempting to retrieve controller details or
  synchronization time. Hits from attacker IPs are high-confidence leads.
reads:
- device_hostname
- src_endpoint_ip
- status_code
- time
- url_full
- url_path
- url_query
- user_agent
silence: not_evidence_of_absence
source: hb_http_activity
verified: dry-run
verified_at: '2026-11-10'
~~~
SELECT device_hostname, src_endpoint_ip, url_path, url_query, user_agent, status_code, time FROM hb_http_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (LOWER(url_path) = LOWER('{{target_endpoint}}') OR LOWER(url_full) LIKE '%' || LOWER('{{target_endpoint}}') || '%') AND (LOWER(url_query) LIKE '%read_units%' OR LOWER(url_query) LIKE '%read_date_time%' OR instr(',' || '{{attacker_ips}}' || ',', ',' || src_endpoint_ip || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')
```

## external-ip-prevalence
<!-- Baseline External IP Activity to Danfoss Endpoints -->
Stack-count external IPs hitting the targeted endpoint to distinguish broad scanners from targeted exploiters.

```sqlite target=web role=baseline params=(target_endpoint=target_endpoint, lookback_days=lookback_days)
~~~yaml
baseline:
  compare: first_seen
  window: '{{lookback_days}}d'
expected: An IP hitting a large number of hosts suggests a wide scanner; an IP hitting
  only one or two controllers may indicate a targeted exploit attempt.
prevalence:
  by: device_hostname
  key:
  - src_endpoint_ip
  rare_below: 2
reads:
- device_hostname
- src_endpoint_ip
- time
- url_full
- url_path
silence: not_evidence_of_absence
source: hb_http_activity
verified: dry-run
verified_at: '2026-11-10'
~~~
SELECT src_endpoint_ip, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen, MAX(time) AS last_seen FROM hb_http_activity WHERE (LOWER(url_path) = LOWER('{{target_endpoint}}') OR LOWER(url_full) LIKE '%' || LOWER('{{target_endpoint}}') || '%') AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY src_endpoint_ip ORDER BY host_count ASC
```

## exposed-asset-check
<!-- Verify Asset Exposure via Public Scanning Data -->
Cross-reference internal Danfoss assets with known public exposures.

```sqlite target=endpoint role=enrichment
~~~yaml
expected: Matches confirm that specific controllers are publicly reachable and known
  to scanners like Shodan or Censys.
reads:
- discovered_at
- domain_or_ip
- port
- product
- source_product
- version
silence: not_evidence_of_absence
source: hb_exposed_assets
verified: dry-run
verified_at: '2026-11-10'
~~~
SELECT domain_or_ip, port, product, version, discovered_at FROM hb_exposed_assets WHERE LOWER(product) LIKE '%danfoss%' OR LOWER(source_product) LIKE '%danfoss%'
```

## triage-agent
<!-- Triage Reconnaissance and Sync Evidence -->
```agent target=hunter
cite: required
context:
- scoping-danfoss-inventory
- http-recon-sync-activity
- external-ip-prevalence
- exposed-asset-check
max_iterations: 5
objective: Evaluate the rows from inventory, HTTP activity, and exposure logs to determine
  if any host has been targeted for exploit synchronization or reconnaissance. Focus
  on external IPs hitting only few hosts with read_units or read_date_time actions.
success_criteria: A verdict of malicious (exploit sync detected), suspicious (recon
  detected), or benign per host.
tools:
- endpoint
- web
```

## route-verdict
<!-- Route on Verdict -->
if~: "the triage verdict is malicious for at least one host" (confidence: high, judge=hunter)
then: → isolate-host
indeterminate: → analyst-review-task
unavailable: → analyst-review-task (blind_spot: limited-visibility-into-unmanaged-networks)
else: → analyst-review-task

## isolate-host
<!-- Isolate Affected Controller -->
```action target=endpoint
~~~yaml
approval: required
~~~
Remove the affected Danfoss controller from any direct internet-facing exposure. Place it behind a VPN or firewall with strict access controls. Collect logs from the device for further analysis.
```
→ analyst-review-task

## analyst-review-task
<!-- Analyst Verification and Remediation -->
```manual target=analyst
Review the cited HTTP activity for any confirmed exploit synchronization. Identify all controllers running firmware versions older than 4.2. Work with site administrators to apply Danfoss security updates and change default administrative passwords.
```
→ close-out-task

## close-out-task
<!-- Close Out and Record Findings -->
```manual target=analyst
Document the number of controllers affected and the volume of suspicious reconnaissance traffic observed. Note any controllers that were discovered through the hunt but were missing from official inventory.
```
→ end