Refrigeration controllers originally built to monitor supermarket cold storage are now actively functioning as spam email distributors and covert traffic relays across global digital networks.
SecurityScorecard’s threat intelligence group, STRIKE, released a detailed report on November 11 detailing how internet-exposed XWEB PRO controllers are hijacked for malicious cyber infrastructure. This follows a wave of incidents across Europe where commercial cooling units suffered remote temperature tampering.
Manufactured by Dixell and sold under the Copeland brand, the XWEB PRO operates as a specialized industrial control system that communicates with individual refrigeration cases and supplies a web interface. While technicians rely on these devices to monitor temperatures and adjust settings remotely, the hardware functions essentially as a small Linux computer with its own CPU and network connection.
Unlike standard enterprise servers, these controllers lack regular logging and monitoring mechanisms. Consequently, unauthorized actors can maintain undetected access to the systems for weeks or months at a time. Through Driftnet asset search data and network flow analysis, the STRIKE team identified nine refrigeration controller IP addresses performing outbound Simple Mail Transfer Protocol communication, with three traced directly to XWEB units.
Attackers routinely gain entry to these devices by exploiting a pre-authentication bypass vulnerability tracked as CVE-2026-25085. The security flaw stems from the controller’s login verification function written in the Lua script language, which incorrectly treats blank return values as valid authentication tokens during unusual login attempts.
Once inside, malicious operators convert the cooling management hardware into a traffic relay. SecurityScorecard identified an incident where an XWEB PRO controller located in Namibia was seized to establish secret connection tunnels with neighboring South Africa, routing approximately 1.24 million external connection requests.
| Device Location | Exploited Function | Observed Traffic Volume |
|---|---|---|
| Namibia | Tunnel Gateway | 1.24 million connections |
| Trinidad and Tobago | Proxy Exit Node | 10,000+ signals over 17 hours |
Another controller in Trinidad and Tobago operated for 17 hours as a proxy exit node, exchanging signals with over 10,000 distinct computers to mask the true origin of cyber attacks behind residential-looking internet traffic. These incidents run parallel to physical disruptions observed in European supermarkets where remote temperature spikes reached up to 50 degrees Celsius, destroying large quantities of food across Belgium, Sweden, Finland, Ireland, Luxembourg, and Estonia.
“This investigation demonstrates how exposed industrial control systems can be repurposed beyond their operational purpose into criminal infrastructure,” said a SecurityScorecard representative, urging administrators to immediately inspect internet-exposed XWEB controllers for vulnerable firmware.
The STRIKE team advises security personnel to closely monitor outbound connections through ports 25, 465, and 587 on external-facing equipment, and to verify whether multiple nodes share identical email recipient targets.
