Researchers Find Hijacked Copeland XWEB Refrigeration Controllers Sending Spam and Proxy Traffic
SecurityScorecard tied nine IP addresses, three of them confirmed XWEB controllers, to a suspected spam botnet first seen Nov. 2. Separately, Ransom-ISAC documented 743 parameter writes across 31 refrigeration devices at one site that still used its factory Administrator login.
Copeland XWEB Pro refrigeration controllers left reachable from the public internet are being used to send spam and relay other people's traffic, SecurityScorecard's STRIKE threat intelligence team reported Nov. 5. A day later, the incident-response group Ransom-ISAC published the event log from a separate XWEB Pro compromise in which two administrator sessions rewrote settings on 31 refrigeration devices in about 35 minutes.
XWEB Pro, originally a Dixell product and now sold under the Copeland name, is the supervisory controller that sits above a store's case and rack controllers and gives technicians remote access to setpoints and alarms over a web interface.
Nine Mail Senders, Three of Them Controllers
SecurityScorecard researchers Patrick Burns and Gilad Friedenriech Maizles said they first saw the activity on Nov. 2 in network flow data from exposed XWEB panels. Nine IP addresses were sending outbound mail on ports 25, 465 and 587 in small bursts of about 250 bytes and receiving none. A passive read of TLS certificates and page titles confirmed three as genuine XWEB Pro or XWEB EVO units. Of 1,041 mail targets, 508 were hit by two or more of the nine addresses, an overlap the researchers read as a single coordinated operator.
Two other controllers had been turned to different work. One in Namibia carried 71 percent of all flows in the capture, about 1.24 million sessions to a single host in South Africa, acting as a tunnel gateway. Another in Trinidad and Tobago reached 10,643 distinct peers in 17 hours, behavior the team matched to a residential proxy exit. "Exposed ICS is dual-purpose infrastructure," the authors wrote. They rated their overall confidence low to medium and said the addresses should be treated as victims, not attacker-owned machines.
The likely way in, according to SecurityScorecard, is CVE-2026-25085, a login check flaw that lets an unauthenticated user past the password prompt. It is one of 23 vulnerabilities Claroty Team82 researcher Amir Zaltzman reported in XWEB 300D, 500D and 500B Pro firmware 1.12.1 and earlier, published by CISA in advisory ICSA-26-057-10 on Feb. 26. Copeland has issued a fix, available from its software update page or through the controller's SYSTEM, Updates, Network menu.
743 Writes, No Exploit Needed
The Ransom-ISAC case, written up by Massimo Giaimo, involved a controller running XWEB Pro 1.9.0 at an unnamed commercial refrigeration site. Starting around 3:10 a.m. on Nov. 2, an Administrator session from an Australian address read parameters across 31 devices, then made 588 writes to 26 of them in about six minutes. A second session from the Netherlands made 155 more across five cold rooms. Setpoints went to 110 C and 150 C, alarm thresholds to values such as 150 or 255, and the log records alarm mutes, keypad locks and defrost commands. The controller still used its factory Administrator credentials.
The log cannot show what temperatures the cases actually reached. Ransom-ISAC said it found no evidence tying the incident to the groups that claimed the supermarket attacks, and SecurityScorecard likewise has not linked its botnet to them.
Why This Matters to Contractors
The first session's pace, about 98 parameter writes a minute, is something no technician produces, and Ransom-ISAC suggests alerting on more than about 20 writes a minute from one account or on writes to more than three devices within five minutes. Its log also shows a fleet-wide parameter read starting about five minutes before the first change, the earliest warning on record at that site. Those thresholds can be set in whatever monitoring watches the supervisor, which complements the downstream setpoint limits in the Nov. 5 federal fact sheet.
Sources
- SecurityScorecard STRIKE, Patrick Burns and Gilad Friedenriech Maizles, "A Dish Served Lukewarm: The Refrigerator Botnet," Nov. 5, 2026. securityscorecard.com
- Ransom-ISAC, Massimo Giaimo, "The Copeland Incident," Nov. 6, 2026. ransom-isac.org
- CISA, "Copeland XWEB and XWEB Pro," ICS advisory ICSA-26-057-10, Feb. 26, 2026. cisa.gov
- Help Net Security, "Hackers abuse refrigeration controllers to send spam and route proxy traffic," Nov. 9, 2026. helpnetsecurity.com