Security companies detect hacking attempts
8th November 2026
UK: A cybersecurity company has revealed it detected multiple authentication attempts on Danfoss AK-SM refrigeration controllers in the days leading up to last week’s spate of cyber attacks.
Glasgow-based company Lupovis has revealed it detected reconnaissance targeting Danfoss refrigeration controllers since October 20.
The company detected over 276 attempts coming from 91 different threat actors matching specific components of Danfoss controllers during this 10-day period. Activity peaked on 26 October, before coming to a halt at the end of the month.
Most adversaries attempted to authenticate using the publicly documented factory-default username and password credentials.
Previously, another cyber security company, Forescout Technologies, revealed that since January, it tracked and identified over 20 claimed attacks against refrigeration systems.
The most active groups behind these attacks were Z-Pentest Alliance and NoName057(16), both pro-Russian.
The company identified 12,976 internet-exposed service observations across 10 product groups, represented by 6,017 distinct public IP addresses in 99 countries and territories. This included 7,075 Copeland/Dixell XWEB services, 4,697 Danfoss StoreView services, 551 Copeland Site Supervisor services, 513 Carel pCOWeb services and 140 other services across six product groups.
