--- analysis: A static detection rule for specific IPs fails when the adversary rotates infrastructure. This hunt uses interaction prevalence to find rare external actors targeting the administrative CGI interface and correlates it with known OT-specific exploit strings. blind_spots: - id: encrypted-traffic-blindness owner: Network Security question: whether attackers are using HTTPS to communicate with the xml.cgi endpoint remediation: Enable TLS inspection for known ICS management endpoints. requires: TLS inspection risk: If controllers are accessed via HTTPS without proxy decryption, hb_http_activity will not contain the URL paths, hiding exploit attempts. stage: brute-force-spraying - id: post-body-parameters owner: SOC Engineering question: what parameters were modified if sent via POST rather than GET query strings remediation: Configure sensor to capture headers and body for administrative CGI paths. requires: HTTP POST body logging risk: The hb_http_activity surface only captures URL components. Commands sent in the POST body are invisible to this hunt. stage: parameter-sabotage coverage: - stage: brute-force-spraying status: covered steps: - cgi-exploit-indicators - management-ip-prevalence - stage: unauthenticated-account-takeover status: covered steps: - cgi-exploit-indicators - triage-activity - stage: parameter-sabotage status: covered steps: - cgi-exploit-indicators - triage-activity - reason: 'Belongs to another part of the ''The Cold Chain on Fire : Unpatched Danfoss controllers exploited'' series.' stage: recon-and-info-theft status: out_of_scope - reason: 'Belongs to another part of the ''The Cold Chain on Fire : Unpatched Danfoss controllers exploited'' series.' stage: exploit-synchronization status: out_of_scope guardrails: claims: no_unsupported evidence: citation_required missing_data: not_benign telemetry: untrusted hunt: applicability: campaign-specific handoff: keep-as-periodic-hunt justification: Direct financial impact from mass food spoilage and physical damage to assets makes the verification of these internet-exposed controllers a critical priority. methodology: model-assisted trigger: intel-report hypothesis: An attacker is hijacking administrative accounts on refrigeration controllers via unauthenticated CGI endpoints to sabotage operational parameters like temperature and defrost cycles. labels: - hunt - attack.t1190 - attack.t1555 - attack.t1041 - credential access - impact - initial access name: Unauthorized Controller Takeover and Sabotage parameters: lookback_days: default: '14' description: Days of historical activity to examine. from: kind: manual observed: '2026-11-09' ref: standard-retention type: number malicious_ips: default: - 178.83.226.215 - 37.16.75.128 description: IP addresses identified in the second wave of attacks. from: kind: article observed: '2026-11-09' ref: sekoia-danfoss-report type: list[ip] scope_hosts: default: [] description: Hostnames or IP addresses of identified controllers; leave empty to hunt across the entire estate. from: kind: manual observed: '2026-11-09' ref: analyst-scoping type: list[host] provenance: authors: - name: Huntbase hunt generation org: huntbase.io generated: by: huntbase-hunt-generation from: https://www.sekoia.com/blog/the-cold-chain-on-fire-unpatched-danfoss-controllers-exploited gates: - dry-run - lint model: hb_google/gemini-3-flash-preview rationale: Focus on subnets hosting refrigeration and building automation systems. Use hb_exposed_assets to identify controllers that may not be under standard endpoint management. references: - name: "Sekoia \u2014 The Cold Chain on Fire: Unpatched Danfoss controllers exploited" url: https://www.sekoia.com/blog/the-cold-chain-on-fire-unpatched-danfoss-controllers-exploited related: - hunt: ot-external-exposure-audit reason: This hunt detects active takeover; a separate audit is needed to identify all exposed OT assets regardless of activity. relation: out-of-scope-alternative - hunt: exposed-danfoss-recon-exploitation relation: follows scenario: stages: - name: Controller Enumeration and Information Theft observables: - xml.cgi - read_units action - retrieval of store identity and location from controller configuration slug: recon-and-info-theft tactic: initial-access techniques: - T1190 - T1041 - name: Bypass Synchronization via Time Check observables: - read_date_time action - xml.cgi - CVE-2025-41450 slug: exploit-synchronization tactic: initial-access techniques: - T1190 - name: Credential Spraying of Default Accounts observables: - Supervisor account - admin account - password "12345" - xml.cgi slug: brute-force-spraying tactic: credential-access techniques: - T1555 - name: Unauthorized User Account Takeover observables: - unauthenticated renaming of user ID 1 - unauthenticated password reset requests - IP 178.83.226.215 - IP 37.16.75.128 slug: unauthenticated-account-takeover tactic: credential-access techniques: - T1555 - name: Malicious Modification of Control Parameters observables: - temperature modification from 50 to 80C - temperature reprogrammed to 110C - modified defrost cycles - modified alarm thresholds slug: parameter-sabotage tactic: impact techniques: - T1190 summary: Threat actors exploited unpatched, internet-exposed Danfoss refrigeration controllers to sabotage temperature and defrost settings, causing significant operational disruption and food spoilage across European supermarket chains. The campaign utilized unauthenticated vulnerabilities, such as CVE-2025-41450 and an account-renaming exploit, to bypass authentication and gain administrative control over the controllers. series: index: 2 slug: the-cold-chain-on-fire-unpatched-danfoss-controllers-exploited title: 'The Cold Chain on Fire : Unpatched Danfoss controllers exploited' total: 2 severity: critical targets: analyst: name: Tier-2 analyst role: analyst endpoint: category: endpoint name: Endpoint telemetry (hb_ surfaces) telemetry: - endpoint hunter: agent: true name: Hunt agent web: category: siem name: Web server / proxy logs telemetry: - network tlp: clear type: investigation --- # Unauthorized Controller Takeover and Sabotage This hunt identifies exposed Danfoss refrigeration controllers and searches for evidence of administrative takeover. It focuses on the exploitation of xml.cgi, where unauthenticated requests can rename administrative accounts and reset passwords. The hunt uses HTTP activity to detect both known attacker IP addresses and anomalous access patterns to management interfaces, followed by an agent-led triage to verify if parameter sabotage has occurred. ## find-danfoss-inventory Locate internet-exposed assets identified as Danfoss controllers via external scan data. ```sqlite target=endpoint role=scoping ~~~yaml expected: A list of hostnames or IPs corresponding to refrigeration controllers. Silence means no Danfoss devices were found in the exposure inventory. reads: - domain_or_ip - product - source_product silence: not_evidence_of_absence source: hb_exposed_assets verified: dry-run verified_at: '2026-11-10' ~~~ SELECT DISTINCT domain_or_ip AS device_hostname FROM hb_exposed_assets WHERE LOWER(product) LIKE '%danfoss%' OR LOWER(source_product) LIKE '%danfoss%' ``` ## exploit-fan-out parallel: - → cgi-exploit-indicators - → management-ip-prevalence join: → triage-activity ## cgi-exploit-indicators Find successful HTTP requests to the xml.cgi endpoint associated with hijacking and parameter modification. ```sqlite target=web role=detection-candidate params=(malicious_ips=malicious_ips, scope_hosts=scope_hosts, lookback_days=lookback_days) ~~~yaml expected: Requests showing successful interactions using OT-specific exploit strings. Silence means no known exploit patterns resulted in success. reads: - device_hostname - src_endpoint_ip - url_path - url_query - status_code - time silence: not_evidence_of_absence source: hb_http_activity verified: dry-run verified_at: '2026-11-10' ~~~ SELECT device_hostname, src_endpoint_ip, url_path, url_query, status_code, time FROM hb_http_activity WHERE (LOWER(url_path) LIKE '%xml.cgi%' OR LOWER(url_query) LIKE '%xml.cgi%') AND status_code IN (200, 204) AND (instr(',' || '{{malicious_ips}}' || ',', ',' || src_endpoint_ip || ',') > 0 OR LOWER(url_query) LIKE '%rename%' OR LOWER(url_query) LIKE '%read_units%' OR LOWER(url_query) LIKE '%read_date_time%' OR LOWER(url_query) LIKE '%set_temp%' OR LOWER(url_query) LIKE '%defrost%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ``` ## management-ip-prevalence Identify rare external IP addresses interacting with the CGI interface, excluding internal management subnets. ```sqlite target=web role=baseline params=(scope_hosts=scope_hosts, lookback_days=lookback_days) ~~~yaml baseline: compare: first_seen window: '{{lookback_days}}d' expected: Anomalous external IPs that talk to only one or two controllers. Silence suggests only internal or broad fleet-wide management is occurring. prevalence: by: device_hostname key: - src_endpoint_ip rare_below: 3 reads: - src_endpoint_ip - device_hostname - time silence: not_evidence_of_absence source: hb_http_activity verified: dry-run verified_at: '2026-11-10' ~~~ SELECT src_endpoint_ip, COUNT(DISTINCT device_hostname) AS affected_hosts, COUNT(*) AS request_count, MIN(time) AS first_seen FROM hb_http_activity WHERE (LOWER(url_path) LIKE '%xml.cgi%' OR LOWER(url_query) LIKE '%xml.cgi%') AND NOT (src_endpoint_ip LIKE '10.%' OR src_endpoint_ip LIKE '192.168.%' OR src_endpoint_ip LIKE '172.16.%' OR src_endpoint_ip LIKE '172.17.%' OR src_endpoint_ip LIKE '172.18.%' OR src_endpoint_ip LIKE '172.19.%' OR src_endpoint_ip LIKE '172.2%.%' OR src_endpoint_ip LIKE '172.30.%' OR src_endpoint_ip LIKE '172.31.%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY src_endpoint_ip HAVING affected_hosts <= 2 ORDER BY request_count DESC ``` ## triage-activity ```agent target=hunter cite: required context: - find-danfoss-inventory - cgi-exploit-indicators - management-ip-prevalence max_iterations: 5 objective: Determine if any Danfoss controller has been subjected to unauthorized account renaming or parameter sabotage by weighing the source IP rarity against the specific CGI query verbs used. success_criteria: A per-host verdict of malicious | suspicious | benign, citing specific URL query strings that indicate sabotage. tools: - endpoint - web ``` ## route-on-verdict if~: "the triage-activity verdict is malicious for at least one host, indicating successful account renaming or parameter modification by an external actor" (confidence: high, judge=hunter) then: → isolate-impacted-controller indeterminate: → analyst-manual-review unavailable: → analyst-manual-review (blind_spot: encrypted-traffic-blindness) else: → close-out-hunt ## isolate-impacted-controller ```action target=endpoint ~~~yaml approval: required ~~~ Isolate the controller at the network gateway or switch port. Block the identified attacker IP addresses at the perimeter. Notify on-site maintenance to manually verify and restore refrigeration settings. ``` → analyst-manual-review ## analyst-manual-review ```manual target=analyst Examine the url_query and url_path columns for the strings 'rename' or 'set_temp'. Verify if the source IP belongs to an authorized external maintenance provider. Check for unauthorized setting changes from the reported October or November timeframe. ``` → end ## close-out-hunt ```manual target=analyst No active sabotage detected. Ensure that identified Danfoss controllers are prioritized for firmware updates to remediate unauthenticated account manipulation vulnerabilities. ``` → end