Vulnerabilities
Copeland XWEB fridge controllers hijacked for spam and proxies
Exposed Copeland XWEB Pro refrigeration supervisors are sending spam, relaying proxy traffic and having setpoints pushed to 150°C. Fixes and checks.
Two research teams published separate findings on November 5 and 6 about Copeland XWEB Pro, the web supervisor (originally sold under the Dixell brand) that runs the cases and cold rooms in many supermarkets and cold stores. SecurityScorecard's STRIKE team found exposed XWEB units sending spam and carrying other people's traffic as proxies from November 2. Ransom-ISAC described a separate break-in on the same night, in which two administrator sessions rewrote 743 parameters across 31 refrigeration devices, set targets as high as 150°C and sent commands to mute alarms.
You are affected if you run an XWEB 300D PRO, 500D PRO or 500B PRO on firmware 1.12.1 or older, and especially if its web interface can be reached from the internet. That covers most units that have not been touched since February, when CISA published advisory ICSA-26-057-10 for 23 flaws found by Claroty Team82. Copeland's fix is firmware 1.13. A refrigeration contractor often manages these boxes, so the owner may not know which version is running.
How it works
An XWEB Pro supervises the individual case and cold room controllers on a site. Through its web interface a technician can read every device, change setpoints and defrost settings, silence alarms and lock the local keypads. Contractors usually reach it remotely, and some installs simply forward a public port to it.
That gives attackers two ways in. The first needs no flaw at all: Ransom-ISAC's victim was reachable from the internet and still used the factory Administrator password. The second is CVE-2026-25085 (CVSS 8.6), which SecurityScorecard names as the likely entry point for the botnet. The login check in the XWEB firmware is written in Lua; when it receives a login type it does not recognise, the function returns an empty result, and the calling code treats that as a pass. An attacker who sends an unexpected login type is logged in without a password.
The rest of the February advisory explains why a logged-in attacker owns the box. Team82's 23 CVEs include an administrator password derived from the date, the device MAC address and key material in the firmware, and 19 command injection flaws in functions such as network configuration, contact list import and firmware update. Command injection lets the attacker run their own commands on the supervisor, which is what it takes to turn it into a mail sender or a tunnel.
What attackers are doing
The botnet. STRIKE filtered internet scan data down to genuine XWEB devices, then looked at their traffic. Nine addresses first seen on November 2 sent mail to ports 25, 465 and 587 in small flows of about 250 bytes and received none; three of them were confirmed as XWEB by their TLS certificates or web page titles ("XWEB PRO", "Dixell", "XWEB EVO"). The three busiest nodes hit 612, 533 and 531 mail targets and shared about 47% of them, and 508 of 1,041 targets were hit by two or more nodes, which points to one operator with one target list.
Two more controllers had other jobs. One in Namibia acted as a tunnel gateway and carried about 71% of all captured flows, including roughly 1.24 million outbound sessions to a single host. One in Trinidad and Tobago contacted 10,643 distinct hosts in 17 hours, with 99.6% of its traffic starting on the device, which STRIKE reads as a residential proxy exit. STRIKE rates its overall confidence as low to medium, says the listed addresses belong to victims rather than the operator, and has not linked the botnet to the European supermarket attacks.
The setpoint attack. Ransom-ISAC's timeline for November 2 starts with an Administrator login at about 03:10 from an Australian VPS address, 198.251.85.67. The session read parameters from 31 devices in four minutes, then made 588 writes across 26 of them in six minutes, about 98 writes a minute. A second Administrator session from 85.137.52.63, a Netherlands address, began at about 03:36 and made 155 writes across five cold rooms. Setpoints went to 110°C and 150°C, alarm limits to values such as 150 or 255, and defrost intervals and termination values were changed. Both sessions sent alarm mute and keypad lock commands, and two units received defrost commands.
The XWEB event log recorded every read, write and command, but not the actual temperatures or whether the changes took effect, so the damage is unknown. Pro-Russian groups NoName057(16) and Z-Pentest claimed the supermarket attacks on November 4, a claim investigators have not confirmed; Ransom-ISAC says it has no evidence linking its case to them or to the attacks in France. The values match the 110°C and 150°C figures reported in the EFS blood service case the same night, but Ransom-ISAC does not name its victim and makes no link.
What to do
- Ask every refrigeration contractor for the model and firmware of each XWEB unit they manage. Anything at 1.12.1 or below is vulnerable.
- Update to firmware 1.13, which Copeland's February bulletin says fixes all the reported flaws. Download it from Copeland's Dixell system software update page for your model, or on a unit with internet access use SYSTEM, then Updates | Network. Ransom-ISAC advises backing up the configuration and logs first and having food safety staff check alarms, sensors and defrost cycles afterwards.
- Change the Administrator password and every other default credential today, whether or not you can update yet. That alone closes the route Ransom-ISAC saw used on November 2.
- Remove direct internet access. Delete port forwards to the XWEB, block it at the upstream firewall, and give contractors a VPN or gateway you run, with multi-factor authentication and named accounts. Search Shodan or Censys for "XWEB" and "Dixell" on your own IP ranges to find units you did not know about.
- Check the controller's own traffic. Outbound connections to TCP 25, 465 or 587 from a refrigeration supervisor, with no inbound mail, are the compromise signal STRIKE describes. So are WireGuard, OpenVPN or IPsec sessions, or thousands of distinct outbound peers. Compare against STRIKE's published addresses, keeping in mind they are other victims.
- Read the XWEB event log for Administrator logins from addresses you do not recognise, bursts of "Wrote parameters" entries, and alarm mute, keyboard lock or defrost commands that did not come from the scheduler. Ransom-ISAC suggests alerting on more than about 20 writes a minute from one account, or writes to more than three devices within five minutes.
- If you find signs of abuse, preserve the logs, cut the unit off the network, restore setpoints and alarm limits from a known-good configuration, rotate credentials from a clean workstation, and check product temperatures with an independent logger before you trust the stock.
The wider lesson
Both incidents show what happens to a controller nobody owns. The fix shipped in February, the advisory was public, and units still sat on the internet with factory passwords nine months later. Put refrigeration and building controllers on the same asset list and patch schedule as your firewalls, and write firmware updates into the maintenance contract with a date attached.
Our attack surface management work finds exposed controllers and supervisors on your address ranges, and safeguarding and hardening moves contractor access behind a path you control. If you are not sure what firmware your refrigeration supervisor runs, open the chat and Yaali, our AI agent, will pass the question to an engineer.
Sources: SecurityScorecard STRIKE: A dish served lukewarm, the refrigerator botnet, Ransom-ISAC: The Copeland incident, CISA ICSA-26-057-10, Copeland XWEB Pro security bulletin, February 2026, INCIBE-CERT advisory, Help Net Security.