Hacks targeting blood bank and supermarket refrigeration equipment have escalated in recent weeks, raising alarms about basic security gaps in internet-connected devices. Wired reported that the attacks hit blood labs and grocery stores, showing how security lapses in connected devices can pose real risks to critical infrastructure. A security researcher has built a honeypot called Coldframe that disguises itself as a supermarket refrigeration controller to lure and analyze attacker behavior.
Escalating attacks and the honeypot project
Wired reported that industrial refrigeration installations have been hit by a series of hacks over the past few weeks, with the attacks spreading from blood labs to supermarkets. The incidents prompted the researcher to act. The developer announced Coldframe on Hacker News, saying it was inspired by "the events on industrial fridge installations in the past weeks" and aimed to see how attackers would go after a convincing fake target.
Coldframe mimics the interfaces of two common refrigeration controllers: the Danfoss AK-SM 800A and the Dixell XWEB. The developer said both fake interfaces are recognized on Shodan, the internet-of-things device search engine, as real devices rather than honeypots. The tool is written using only the Python standard library and builds on the eppser/danfoss-ak-sm-decoy project and public research from Synacktiv, Claroty and Ironhackers.
Technical details and attack detection
To make the honeypot convincing, the developer used records of real devices on Shodan to match HTTP header order, page titles, certificate fields and TLS versions. For example, the Danfoss simulation sends nginx headers in the same order as a real AK-SM 800A; the Dixell simulation sends no Server header and pads its page to exactly 8,202 bytes.
The honeypot can also identify specific exploit attempts, including the Danfoss "daily code" login bypass vulnerability CVE-2025-41450, and records whether the submitted code matches the correct code for that day. It also flags attack attempts against three other Danfoss CVEs and XWEB vulnerabilities. The honeypot lets attackers log in with default credentials to a fake store dashboard with interactive elements such as a defrost button, so the developer can watch what they do next — but there is no real system behind it.
"The default login opens a fake store dashboard with a defrost button, so you can see the second step, not just the first attempt. There's nothing real behind it," the developer wrote on Hacker News.
Early runs and what comes next
Two honeypot instances have been running for a day. The developer said they have so far only seen generic scanners and a Shodan crawler named refrigerator.census.shodan.io. The developer welcomed feedback but did not disclose further details.
The honeypot project comes as attacks on refrigeration equipment draw widespread attention. Wired described the incidents as an "Internet-of-Things wake-up call," stressing the serious consequences that basic security lapses can bring. The specific source and motive of the attacks remain unclear, but security researchers are gathering intelligence through honeypots and other means to better understand the threat and defend against future attacks.