A group of hackers with links to the Russian state may be behind the cyberattack on refrigeration systems in European supermarkets, according to Xavier Bellekens, CEO of the Scottish cybersecurity firm Lupovis. In the week leading up to the attacks, his company noticed a striking number of attempts to breach simulated control systems for refrigerators. “It seems that someone wants to demonstrate that they can cause damage to a crucial part of European infrastructure.”
Cyberattack on supermarket refrigeration systems "may be the work of hackers with links to Russia"
Published:
On Monday the Belgian supermarket sector was on high alert after dozens of shops fell victim to a cyberattack on their refrigeration systems.
At stores including Delhaize, Carrefour and Spar, temperatures in the refrigeration and freezer units rose. As a result, some supermarkets had to remove food from the shelves or throw it away. Problems were also reported in Sweden, Estonia, Luxembourg and Ireland.
Spike in cyberattacks
Xavier Bellekens, a Belgian cybersecurity specialist who has been living in the United Kingdom for 17 years, is following events closely. His company, Lupovis, monitors thousands of so-called ‘honeypots’ worldwide: simulated computer systems and devices designed to attract cybercriminals.
“You could compare it to a fake house on a street,” he explains. “Nobody lives there, but you hope that one day a burglar will try to break in. By observing how he goes about it, you can gather information about his methods and his intentions.”
Among other things, Lupovis had replicated a control system from Danfoss. This Danish technology company supplies software that enables cooling systems to be managed remotely. Danfoss had already been targeted by cybercriminals during the first cyberattack in mid-October.
Between 20 and 30 October, Lupovis recorded 256 attempts to breach the simulated Danfoss systems. These originated from 91 different sources. On 26 October, there was a clear spike in activity.
“Normally, we see constant attempts to attack all sorts of technologies. We call that ‘background noise’,” explains Bellekens. “But when we suddenly see a spike in activity targeting one specific type of technology, and that across several countries at the same time, it suggests that someone has a particular interest in that system.”
According to Bellekens, it is no coincidence that this increased activity took place in the week leading to cyberattacks on European supermarkets. He suspects that the hackers first went through a reconnaissance phase, before launching the attack in early November. “On 1 and 2 November, we then saw the attack carried out.”
Various clues pointing to Russia
The data gathered by Lupovis leads Bellekens to suspect that the attacks are the work of a group with links to the Russian state. His company cannot identify the perpetrators with certainty, but various elements point in the same direction.
One notable factor is the digital infrastructure from which the attacks were launched. Among other things, the hackers made use of so-called ‘bulletproof hosting’: internet services that deliberately provide cybercriminals with the space to carry out illegal activities. Complaints about abuse are often ignored, making it difficult to take the servers offline.
‘Furthermore, the internet service providers and some of the IP addresses we have identified were already present in infrastructures that we have previously linked to Russian state-affiliated hacker groups,’ said Bellekens. ‘When we compare that data with previous attacks, we see a clear overlap.’
He also believes that the scale and technical approach of the attack suggest there is more to it than just a single hacker. The attacks affected various supermarket chains across several countries. Furthermore, the perpetrators would have needed a thorough understanding of how industrial refrigeration systems work in order to actually cause damage.
“To damage refrigeration systems in this way, you need to understand how they function. You need to know how the cooling and defrost cycles work and which settings you can adjust. In this case, the defrost cycles were constantly being reactivated, causing the temperature in the systems to keep rising. That’s not easy. To do that, you need to delve into the technical documentation and know how to cause damage. A teenager sitting in their bedroom couldn’t pull something like that off.”
Finally, it is striking that, as yet, no hacker group has claimed responsibility for the attack. “Normally, such attacks are claimed by an organisation. In this case, however, no group has done so as yet.”