atisusanti
French authorities have confirmed that critical refrigeration units used in medical facilities to store vital blood donations were compromised by sophisticated cyber-attacks orchestrated by unknown hackers, a development that has sent ripples of concern through the nation’s healthcare infrastructure. The French Blood Establishment (EFS) revealed that cold rooms housing blood supplies experienced temperature fluctuations as a direct result of the malicious digital intrusions. Fortunately, swift intervention by dedicated EFS staff prevented any widespread spoilage, safeguarding the integrity of the blood reserves. "No health impact has been identified and no loss of blood products is to be reported," the EFS stated in a press release, offering a crucial reassurance to the public. This incident marks a significant escalation from previous attacks, which had primarily affected the retail sector, with supermarkets being the known targets until this alarming breach into the medical supply chain.
Amidst the ongoing investigation, a torrent of speculation has erupted online, fueled by claims from purported Russian hacktivist groups. Groups such as Noname057(16) and Z-Pentest Alliance have publicly asserted their involvement, alleging a successful hack of Danfoss, a company whose systems are reportedly used in some of the affected freezer units. This assertion has naturally led to widespread conjecture that these groups are the masterminds behind the widespread freezer hacks impacting European supermarkets. However, seasoned cybersecurity analysts are now casting a critical eye on these claims, questioning the veracity and scope of the alleged involvement, and whether their purported hacking capabilities extend beyond denial-of-service attacks to the more intricate manipulation of industrial control systems.
While Russian actors are not being entirely discounted as potential perpetrators, cybersecurity experts are cautioning against premature conclusions. The sophisticated nature and wide reach of these attacks suggest a broader spectrum of possibilities, with Iranian hacktivists and even nation-state actors being considered as plausible culprits. Adding another layer of complexity to the investigation, the possibility of prank-playing teenagers with an advanced understanding of cybersecurity cannot be entirely dismissed, although the level of coordination suggests a more organized effort. To unravel the mystery, cybersecurity researchers from multiple firms are meticulously examining evidence gathered from strategically deployed "honeypots" – digital decoys designed to lure and trap hackers.
These honeypots, essentially fake computer networks or files designed to mimic vulnerable targets, allow security experts to safely observe and analyze the attackers’ methods without jeopardizing real-world systems. The activity observed in the aftermath of the initial wave of cyber-attacks indicates that the subsequent wave, which impacted several European countries, was remarkably targeted. Ryan Dewhurst, a cybersecurity expert at the Spanish firm Previdian, emphasized the strategic planning involved. "The fact that all these fridge freezers were hit simultaneously suggests planning and coordination," Dewhurst stated, highlighting the synchronized nature of the intrusions.
While the entry points for the affected freezer software products were reportedly easy to exploit due to poor security measures and publicly available attack methods, Dewhurst points out that the attackers had to undertake significant preparatory work. This included gathering information about the devices’ public IP addresses to compile a comprehensive target list, and then meticulously planning the attack methods and execution timing. "Given the reported timing of when the devices had their temperatures increased, which seems to have been overnight for maximum damage – this is further evidence that the attack was planned and co-ordinated," he added, underscoring the deliberate intent to inflict disruption.
Another cybersecurity firm, the Scotland-based Lupovis, has also deployed similar honeypot technology to gain insights into the hackers’ tactics. Lupovis established fake freezer sites across the globe and began observing suspicious activity approximately ten days before the second wave of cyber-attacks. Intriguingly, their surveillance revealed that hackers were exclusively scanning and probing their European honeypots, leaving those in other regions, including Africa and South America, untouched. Even honeypots located in Ukraine were conspicuously ignored. "We saw none of our honeypots in places like Africa or South America targeted at all," remarked Dr. Xavier Bellekens, founder of Lupovis. "Even pots in Ukraine were left alone."
A third firm, the French cyber-defense company Sekoia, also detected scanning activity prior to the second wave of attacks. However, Sekoia noted that this activity could have been automated and not necessarily malicious in intent. In a report shared with its clients, Sekoia indicated that the characteristics of the attack bore similarities to the modus operandi of Russian hacktivists or the Russian government, which has been implicated in a broader pattern of "hybrid warfare" cyber-attacks across Europe. Yet, Sekoia’s research also points towards Iranian regime hackers or hacktivists as potential actors. The report elaborated, "Iranian-aligned actors have an established record of targeting internet-exposed industrial control systems and previous incidents involved the same equipment in Israel and the US – both adversaries of Iran." Sekoia’s findings are corroborated by an incident in 2022, where approximately 40 Israeli supermarkets utilizing Danfoss controllers were reportedly compromised.
Adding to the global scope of these attacks, in late August, freezers at at least six US military bases were also forced into defrost mode, mirroring the incidents in France. While the specific controller models used in the US attacks remain unconfirmed, investigations are actively underway. A spokesperson for Sekoia provided a crucial clarification to the BBC: "To date, we have no technical evidence indicating the involvement of Russian-speaking groups." Furthermore, Sekoia expressed skepticism regarding the claims made by NoName057, stating, "Furthermore, as NoName057 is not known to effectively conduct operations beyond DDoS attacks and has a history of making false attributions, we remain sceptical of their alleged claim of responsibility." Distributed Denial of Service (DDoS) attacks, a known capability of groups like NoName057, function by overwhelming a website or online service with internet traffic, rendering it inaccessible.
Authorities across multiple European nations are actively pursuing investigations into these widespread hacks and are issuing advisories to supermarkets, warning them of potential future attacks. Despite the ongoing efforts, no formal attribution of responsibility has been made by any governmental body. Crucially, none of the three cybersecurity firms gathering honeypot data are completely ruling out the possibility that the attacks could have been orchestrated by a single, highly skilled teenager. However, the significant degree of planning and coordination required for such widespread disruption leads the experts to believe that a well-organized group is the more probable culprit. If indeed a group is behind these sophisticated attacks, the cybersecurity community anticipates that online bragging or admissions of responsibility are likely to surface in the near future. Sekoia also highlighted the possibility that the three distinct waves of attacks, affecting different regions and sectors, could have been carried out by separate and unrelated groups or even by opportunistic copycat actors seeking to emulate the initial breaches. The investigation continues, with cybersecurity professionals worldwide collaborating to piece together the evidence and identify the perpetrators behind this alarming series of cyber-intrusions.
Ramos Leo
Roy Suryo
George Anjay
Nakalama John
