Five U.S. agencies warned that malicious cyber actors are targeting industrial refrigeration and cold chain monitoring systems worldwide. The Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), the Department of Health and Human Services (HHS), the U.S. Department of Agriculture (USDA), and the Department of Transportation (DoT) issued the joint warning.
The agencies said the systems are widely used in the Healthcare and Public Health, Chemical, Food and Agriculture, and Transportation Systems Sectors. Uses include remote temperature monitoring, continuous temperature logging, defrost cycle management, and energy optimization.
The agencies said the actors may exploit weaknesses in unpatched or internet-accessible electronic temperature controllers and commercial refrigeration controllers. The report says the actors may use authentication bypass, arbitrary code injection, and weak configurations. It says successful exploitation could let actors remotely change settings and force units into continuous heating and defrost cycles.
According to the report, possible effects include changes in temperature that could shorten equipment service life, create a fire hazard, cause inventory loss,