OMM Newsroom
Cyber-attacks by unknown hackers affected cold rooms used to store donated blood at medical facilities in France, the French Blood Establishment (EFS) said. Staff intervened after temperatures were set to rise, protecting the blood supplies, according to the BBC.
“No health impact has been identified and no loss of blood products is to be reported,” the EFS said.
Until now, supermarkets were the only facilities known to have been affected by the freezer hacks.
Online claims by Russian hacktivist groups have fuelled speculation about who was responsible. Noname057(16) and Z-Pentest Alliance said they had successfully hacked “Danfoss”, a company whose systems were used in attacks affecting European supermarkets.
Analysts are questioning whether that claim means the groups were behind the supermarket attacks. Experts have not ruled out Russian groups, but say Iranian hacktivists, state-backed hackers or even teenagers could also be responsible.
Cyber-security researchers at three firms are studying evidence gathered through “honeypots” — digital decoys designed to look like vulnerable systems and attract hackers. The traps let researchers examine attackers’ methods without putting real systems at risk.
Evidence collected after the first wave of attacks suggests the second wave, which affected several European countries, was highly targeted. Ryan Dewhurst of Spanish cyber-security company “Previdian” said the simultaneous impact on multiple freezers suggested planning and coordination.
The freezer software was poorly protected, and known ways of exploiting it were already available online. However, Dewhurst said attackers would still have needed to identify the devices’ public IP addresses, compile a target list and decide which methods to use and when.
He said reports that temperatures were raised overnight, when the damage could be greatest, provided further evidence that the attacks were planned and coordinated.
Strathclyde-based cyber firm “Lupovis” also deployed honeypots, which appeared to be located around the world. It detected activity 10 days before the second wave of attacks, with hackers scanning and probing its fake freezer systems only in Europe.
“We saw none of our honeypots in places like Africa or South America targeted at all,” said “Lupovis” founder Dr Xavier Bellekens. “Even pots in Ukraine were left alone.”
Researchers weigh possible links to Russia and Iran
French cyber-defence firm “Sekoia” also detected scanning activity before the second wave, but said it could have been automated scanning without malicious intent.
In a report to customers, “Sekoia” said some evidence was consistent with activity by Russian hacktivists or the Russian government, which has been accused of conducting “hybrid warfare” cyber-attacks across Europe. The firm also pointed to the possibility of Iranian regime hackers or hacktivists.
“Iranian-aligned actors have an established record of targeting internet-exposed industrial control systems and previous incidents involved the same equipment in Israel and the US — both adversaries of Iran,” the report said.
According to “Sekoia”, about 40 Israeli supermarkets using “Danfoss” controllers were compromised in 2022. In late August, freezers at at least six US military bases were forced into defrost mode, as in France. The controller models have not been confirmed and investigations are continuing.
“To date, we have no technical evidence indicating the involvement of Russian-speaking groups,” a “Sekoia” spokesperson told the BBC. The spokesperson said the firm was sceptical of Noname057’s claim, noting that the group was not known for operations beyond distributed denial-of-service (DDoS) attacks and had previously made false claims of responsibility.
DDoS attacks attempt to make a website or online service inaccessible by flooding it with internet traffic.
Authorities in several countries are investigating the hacks and warning supermarkets about possible future attacks. No formal attribution has been made.
None of the three firms studying honeypot data has ruled out the possibility that a teenager was behind the attacks. Researchers say the level of planning would point to a well-coordinated group, which they expect might soon boast about its actions online.
“Sekoia” also said the three waves of attacks could have been carried out by different groups or copycats.
