LONDON (The Thursday Times) — Two Russian hacktivist groups have claimed responsibility for the waves of attacks on supermarket freezers across Europe, but their posts have since been deleted and security researchers are far from convinced.
Noname057(16) and Z-Pentest Alliance said on Telegram that they had worked together, boasting that they had “once again demonstrated a high level of skill and precision”. They also said they had been targeting the freezer software maker Danfoss since the start of this year. Their posts and channels have now gone.
One cybersecurity commentator who shared the claims on X said they were “not convinced it was them”, and that the groups may have stepped forward only after analysts suggested they could be responsible.
Experts have not ruled out Russian groups, but say Iranian hacktivists or state hackers, or even teenagers playing pranks, could also be behind the attacks. The groups’ claim concerned the supermarket hacks, and there is no public finding on who was behind the attack on freezers used by France’s blood service.
Traps for the hackers
Three cybersecurity firms have set up honeypots, fake freezer software meant to lure attackers so that their methods can be studied. Lupovis, based in Scotland, said it saw probing 10 days before the second wave of attacks, and only in Europe. “We saw none of our honeypots in places like Africa or South America targeted at all,” said its founder, Xavier Bellekens.
Ryan Dewhurst of the Spanish firm Previdian said the systems were poorly protected and not hard to break into, with known attack methods already online. But someone still had to build a target list and plan the timing. “The fact that all these fridge freezers were hit simultaneously suggests planning and coordination,” he said.
Russia, or Iran?
The French firm Sequoia told its customers that the attacks fitted the pattern of Russian hacktivists or the Russian government, which has been accused of carrying out cyberattacks across Europe as part of so-called hybrid warfare. Its research also pointed to Iran.
“Iranian-aligned actors have an established record of targeting internet-exposed industrial control systems,” it said, noting that about 40 Israeli supermarkets running Danfoss controllers were compromised in 2022. In late August, freezers at at least six US military bases were forced into defrost mode, as they were in France, although the equipment involved has not been confirmed.
Authorities in several countries are investigating, and have warned supermarkets to expect more attempts.
