A new open-source decoy that looks like a supermarket fridge controller is circulating on Hacker News, built for people who want to watch probes against the same kit hit in recent European food-retail attacks.
Coldframe, published on GitHub by hedgerow-dev under an MIT licence, is one Python file and needs nothing beyond the standard library. A honeypot is a fake system left in plain sight: it looks like a real target so you can log who connects and what they try, without handing over working plant. The author says two live copies have mostly seen generic scanners and Shodan’s refrigerator census crawler so far.
The Show HN post and repository describe personas that mimic Danfoss AK-SM 800A StoreView managers and Copeland/Dixell XWEB EVO supervisors—the same product families named in national alerts after remote defrost incidents. Optional Modbus TCP support can be switched on to catch industrial scanners; it stays off unless you turn it on.
Why fridge supervisors matter
Commercial supermarket freezers are often steered by shared web management boxes. If those interfaces sit on the public internet with weak factory logins or unpatched firmware, an outsider can change setpoints—including forcing long, high-temperature defrost cycles that spoil stock overnight.
That risk is not theoretical. Claroty’s Team82 summarised a mid-October 2026 wave that hit large French chains, with Intermarché alone reporting about 150 stores affected and cases driven toward 50°C. CERT-FR later widened the picture to Copeland and Dixell XWEB as well as Danfoss AK-SM and AK-SC series. On 2–3 November, Claroty and Belgium’s Centre for Cybersecurity described a second wave across several European countries, again tying impact to internet-exposed controllers, default passwords and outdated firmware. Sulat News has not independently audited those retail incidents; the account above follows those public advisories and vendor research notes.
What Coldframe claims to do
According to its README, the Danfoss persona mirrors scanner fingerprints for real AK-SM 800A units: header order, page title, TLS 1.2 and a self-signed certificate subject typical of those devices. Weak logins or a known public authentication bypass then open a fake store dashboard. The Dixell persona copies XWEB EVO web fingerprints and login-flow behaviour. Matched requests are tagged in JSON logs against published CVE identifiers for Danfoss and XWEB flaws, including path traversal, command injection, nginx header abuse and login-bypass classes disclosed by Synacktiv, Claroty Team82 and others. The project says exploit payloads are logged and dropped: nothing real is controlled.
The README is careful about limits. Interaction is shallow; public source can be fingerprinted; some response shapes are “plausible” rather than confirmed from closed firmware; cloud-hosted industrial IPs can look suspicious to scanners. Favicon and exact firmware start-page bytes are left to private deployments that already hold those vendor assets.
What operators should do first
Coldframe is a research and detection aid, not a patch. For real plant, Belgium’s CCB and Claroty still put the basics first. Pull management interfaces off the open internet. Put remote access behind a VPN or equivalent. Change default vendor credentials. Move to current vendor firmware—Danfoss’s DSA-2025-08-01 points AK-SM8xxA customers at 4.3.1 and later for the August 2025 fixes. Inventory who can reach defrost and setpoint controls before trusting a decoy.
Reaction
Mikko Ohtamaa, a well-known open-source developer on X, amplified the Show HN post. He described Coldframe as software that pretends to be a European grocery-store fridge. Earlier high-engagement posts from Aakash Gupta and others had already framed the French supermarket freezer incidents as a cyber-physical cold-chain failure. Hacker News discussion of Coldframe itself was still early when Sulat News checked the thread.
Sources
- hedgerow-dev/coldframe on GitHub
- Show HN: Coldframe (Hacker News)
- Claroty: European supermarket refrigeration hacks
- Claroty Team82: Danfoss AK-SM 800A research
- CCB Belgium advisory on refrigeration controller incidents
- Danfoss DSA-2025-08-01
- Aakash Gupta on X
- Mikko Ohtamaa on X
Discover more from Sulat — AI & Tech News
Subscribe to get the latest posts sent to your email.
