--- analysis: A standing detection rule might flag known IPs, but this hunt baselines external IP behavior to Danfoss endpoints and pivots to inventory and public exposure data to identify targeted synchronization attempts that might rotate IPs. blind_spots: - id: limited-visibility-into-unmanaged-networks question: whether all Danfoss controllers in the estate are reporting inventory requires: hb_software_inventory coverage for all OT segments risk: Unmanaged or shadow OT assets will not be scoped, leaving them vulnerable to undetected exploitation. - id: missing-http-post-bodies question: whether reconnaissance parameters were passed in the HTTP POST body requires: hb_http_activity with request body capture risk: The hunt primarily analyzes URL paths and queries; if parameters like read_units are in the body, the activity will be missed. stage: recon-and-info-theft coverage: - stage: recon-and-info-theft status: covered steps: - http-recon-sync-activity - external-ip-prevalence - exposed-asset-check - stage: exploit-synchronization status: covered steps: - http-recon-sync-activity - reason: 'Belongs to another part of the ''The Cold Chain on Fire : Unpatched Danfoss controllers exploited'' series.' stage: brute-force-spraying status: out_of_scope - reason: 'Belongs to another part of the ''The Cold Chain on Fire : Unpatched Danfoss controllers exploited'' series.' stage: unauthenticated-account-takeover status: out_of_scope - reason: 'Belongs to another part of the ''The Cold Chain on Fire : Unpatched Danfoss controllers exploited'' series.' stage: parameter-sabotage status: out_of_scope guardrails: claims: no_unsupported evidence: citation_required missing_data: not_benign telemetry: untrusted hunt: applicability: campaign-specific handoff: keep-as-periodic-hunt justification: Recent attacks on Danfoss controllers have led to significant financial losses due to food spoilage and safety risks. Confirming the absence of exploit synchronization activity is critical for refrigeration integrity. methodology: model-assisted trigger: intel-report hypothesis: An attacker is enumerating internet-exposed Danfoss controllers and synchronizing system time to bypass authentication via the CVE-2025-41450 vulnerability. labels: - hunt - attack.t1190 - attack.t1041 - credential access - impact - initial access name: Exposed Danfoss Controller Reconnaissance and Exploitation parameters: attacker_ips: default: - 178.83.226.215 - 37.16.75.128 description: Observed attacker IP addresses from recent campaigns. from: kind: article observed: '2026-11-09' ref: sekoia type: list[ip] lookback_days: default: '14' description: Days of history to examine. type: number scope_hosts: default: [] description: Optional list of specific Danfoss hostnames to focus the search. type: list[host] target_endpoint: default: /xml.cgi description: The specific CGI endpoint targeted by the reconnaissance and exploit chain. type: string provenance: authors: - name: Huntbase hunt generation org: huntbase.io generated: by: huntbase-hunt-generation from: https://www.sekoia.com/blog/the-cold-chain-on-fire-unpatched-danfoss-controllers-exploited gates: - dry-run - lint - critic model: hb_google/gemini-3-flash-preview rationale: Initial focus is on all devices identified as Danfoss controllers in the software inventory. This includes systems likely residing on OT or building management subnets. references: - name: "Sekoia \u2014 The Cold Chain on Fire: Unpatched Danfoss controllers exploited" url: https://www.sekoia.com/blog/the-cold-chain-on-fire-unpatched-danfoss-controllers-exploited related: - hunt: ics-default-credential-spraying reason: This hunt focuses on the xml.cgi vulnerability chain; general password spraying against default credentials is covered by a separate sibling hunt. relation: out-of-scope-alternative scenario: stages: - name: Controller Enumeration and Information Theft observables: - xml.cgi - read_units action - retrieval of store identity and location from controller configuration slug: recon-and-info-theft tactic: initial-access techniques: - T1190 - T1041 - name: Bypass Synchronization via Time Check observables: - read_date_time action - xml.cgi - CVE-2025-41450 slug: exploit-synchronization tactic: initial-access techniques: - T1190 - name: Credential Spraying of Default Accounts observables: - Supervisor account - admin account - password "12345" - xml.cgi slug: brute-force-spraying tactic: credential-access techniques: - T1555 - name: Unauthorized User Account Takeover observables: - unauthenticated renaming of user ID 1 - unauthenticated password reset requests - IP 178.83.226.215 - IP 37.16.75.128 slug: unauthenticated-account-takeover tactic: credential-access techniques: - T1555 - name: Malicious Modification of Control Parameters observables: - temperature modification from 50 to 80C - temperature reprogrammed to 110C - modified defrost cycles - modified alarm thresholds slug: parameter-sabotage tactic: impact techniques: - T1190 summary: Threat actors exploited unpatched, internet-exposed Danfoss refrigeration controllers to sabotage temperature and defrost settings, causing significant operational disruption and food spoilage across European supermarket chains. The campaign utilized unauthenticated vulnerabilities, such as CVE-2025-41450 and an account-renaming exploit, to bypass authentication and gain administrative control over the controllers. series: index: 1 slug: the-cold-chain-on-fire-unpatched-danfoss-controllers-exploited title: 'The Cold Chain on Fire : Unpatched Danfoss controllers exploited' total: 2 severity: high targets: analyst: name: Tier-2 analyst role: analyst endpoint: category: endpoint name: Endpoint telemetry (hb_ surfaces) telemetry: - endpoint hunter: agent: true name: Hunt agent web: category: siem name: Web server / proxy logs telemetry: - network tlp: clear type: investigation --- # Exposed Danfoss Controller Reconnaissance and Exploitation This hunt identifies Danfoss refrigeration controllers in the environment and monitors for unauthenticated HTTP requests targeting the xml.cgi endpoint. It specifically searches for 'read_units' actions used for reconnaissance and 'read_date_time' actions required to synchronize an exploit with the controller's internal clock for authentication bypass. An agent correlates these suspicious traffic patterns with known attacker infrastructure and external exposure data to identify targeted exploitation attempts. ## scoping-danfoss-inventory Find every device reporting Danfoss software or firmware to narrow the hunt's focus. ```sqlite target=endpoint role=scoping ~~~yaml expected: A list of hosts likely representing Danfoss controller hardware. Silence indicates no Danfoss assets are managed or inventoried. reads: - device_hostname - package_name - package_version - vendor_name silence: not_evidence_of_absence source: hb_software_inventory verified: dry-run verified_at: '2026-11-10' ~~~ SELECT device_hostname, package_name, package_version, vendor_name FROM hb_software_inventory WHERE LOWER(package_name) LIKE '%danfoss%' OR LOWER(vendor_name) LIKE '%danfoss%' ``` ## investigation-parallel parallel: - → http-recon-sync-activity - → external-ip-prevalence - → exposed-asset-check join: → triage-agent ## http-recon-sync-activity Match specific actions used to enumerate units or read system time for exploit synchronization. ```sqlite target=web role=detection-candidate params=(scope_hosts=scope_hosts, target_endpoint=target_endpoint, attacker_ips=attacker_ips, lookback_days=lookback_days) ~~~yaml expected: Requests from external IPs attempting to retrieve controller details or synchronization time. Hits from attacker IPs are high-confidence leads. reads: - device_hostname - src_endpoint_ip - status_code - time - url_full - url_path - url_query - user_agent silence: not_evidence_of_absence source: hb_http_activity verified: dry-run verified_at: '2026-11-10' ~~~ SELECT device_hostname, src_endpoint_ip, url_path, url_query, user_agent, status_code, time FROM hb_http_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (LOWER(url_path) = LOWER('{{target_endpoint}}') OR LOWER(url_full) LIKE '%' || LOWER('{{target_endpoint}}') || '%') AND (LOWER(url_query) LIKE '%read_units%' OR LOWER(url_query) LIKE '%read_date_time%' OR instr(',' || '{{attacker_ips}}' || ',', ',' || src_endpoint_ip || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ``` ## external-ip-prevalence Stack-count external IPs hitting the targeted endpoint to distinguish broad scanners from targeted exploiters. ```sqlite target=web role=baseline params=(target_endpoint=target_endpoint, lookback_days=lookback_days) ~~~yaml baseline: compare: first_seen window: '{{lookback_days}}d' expected: An IP hitting a large number of hosts suggests a wide scanner; an IP hitting only one or two controllers may indicate a targeted exploit attempt. prevalence: by: device_hostname key: - src_endpoint_ip rare_below: 2 reads: - device_hostname - src_endpoint_ip - time - url_full - url_path silence: not_evidence_of_absence source: hb_http_activity verified: dry-run verified_at: '2026-11-10' ~~~ SELECT src_endpoint_ip, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen, MAX(time) AS last_seen FROM hb_http_activity WHERE (LOWER(url_path) = LOWER('{{target_endpoint}}') OR LOWER(url_full) LIKE '%' || LOWER('{{target_endpoint}}') || '%') AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY src_endpoint_ip ORDER BY host_count ASC ``` ## exposed-asset-check Cross-reference internal Danfoss assets with known public exposures. ```sqlite target=endpoint role=enrichment ~~~yaml expected: Matches confirm that specific controllers are publicly reachable and known to scanners like Shodan or Censys. reads: - discovered_at - domain_or_ip - port - product - source_product - version silence: not_evidence_of_absence source: hb_exposed_assets verified: dry-run verified_at: '2026-11-10' ~~~ SELECT domain_or_ip, port, product, version, discovered_at FROM hb_exposed_assets WHERE LOWER(product) LIKE '%danfoss%' OR LOWER(source_product) LIKE '%danfoss%' ``` ## triage-agent ```agent target=hunter cite: required context: - scoping-danfoss-inventory - http-recon-sync-activity - external-ip-prevalence - exposed-asset-check max_iterations: 5 objective: Evaluate the rows from inventory, HTTP activity, and exposure logs to determine if any host has been targeted for exploit synchronization or reconnaissance. Focus on external IPs hitting only few hosts with read_units or read_date_time actions. success_criteria: A verdict of malicious (exploit sync detected), suspicious (recon detected), or benign per host. tools: - endpoint - web ``` ## route-verdict if~: "the triage verdict is malicious for at least one host" (confidence: high, judge=hunter) then: → isolate-host indeterminate: → analyst-review-task unavailable: → analyst-review-task (blind_spot: limited-visibility-into-unmanaged-networks) else: → analyst-review-task ## isolate-host ```action target=endpoint ~~~yaml approval: required ~~~ Remove the affected Danfoss controller from any direct internet-facing exposure. Place it behind a VPN or firewall with strict access controls. Collect logs from the device for further analysis. ``` → analyst-review-task ## analyst-review-task ```manual target=analyst Review the cited HTTP activity for any confirmed exploit synchronization. Identify all controllers running firmware versions older than 4.2. Work with site administrators to apply Danfoss security updates and change default administrative passwords. ``` → close-out-task ## close-out-task ```manual target=analyst Document the number of controllers affected and the volume of suspicious reconnaissance traffic observed. Note any controllers that were discovered through the hunt but were missing from official inventory. ``` → end