Typed by hand: how a Danfoss refrigeration controller is taken over

A French refrigeration installer photographed the change log of a Danfoss controller that was taken over on the evening of 23 October 2026. It shows two changes, made 22 minutes apart through the web interface: the password of user 1, then the store's name, rewritten to HACKED BY JUDRUD. We run Danfoss decoys built to look like those controllers. This is what that log means on the wire, who has come for our decoys, and what to check on your own controllers.

In brief

• The published log shows a password change on Utilisateur 1, then, 22 minutes later, the Supervisor account renaming the store from "TEST" to "HACKED BY JUDRUD". Both went through the web interface ("via Web/XML").
• Danfoss user guides describe the first user as the Supervisor level by factory default, so the first entry reads as the Supervisor's password being rewritten. It was the store name that was renamed, not an account.
• Only two sources tried to log in to our Danfoss decoys, and both did it by hand, in a browser, with the factory default Supervisor / 12345.
• One of them, 96.9.84[.]190, got in on its second try, spent seven minutes clicking through the inventory and configuration pages, changed nothing, then opened another controller.

The change log, line by line

On 25 October the French installer agyx_france posted a photo of a customer controller's trace log (Info > Tracage), captioned Sacré Judrud... Il a encore frappé ce week-end ! ("That Judrud... he struck again this weekend!")¹. "Again" matters: the installer is describing a repeat visitor, not a first incident.

Under a public post about the same incident, a technician at a second French refrigeration service company commented that a colleague had also had an attack from "this Judrud":

The two entries in the log:

Read in order (the log lists the newest entry first):

1. "via Web/XML" means both changes came through the web interface, which talks XML to /xml.cgi. The browser front end and a script sending the same XML look identical here; what the entry rules out is the front panel or a local service tool.
2. Utilisateur 1 is the first entry in the controller's user table. Danfoss guides describe the first user as the Supervisor level by factory default, with Supervisor / 12345 as the factory login⁵⁶. Entry 00858 is a password change on that account, made by an account whose name the installer blurred.
3. Twenty-two minutes later a Superviseur session changed Nom Mag., the store name. That is a calling card left for whoever opens the controller next, not, by itself, damage to the cold chain.

The installer's caption says the intruder first ran a bot to brute-force the customer account's password, then took over the Supervisor account.

The two changes on the wire

The controller's web interface reads and writes through one endpoint, POST /xml.cgi, with an XML command in the body. Reads such as read_units and read_list fill the pages; list writes (write_list) change tables such as the user list, and value writes (write_val) change single settings. The password change on user 1 and the store rename in the JUDRUD log are two such writes, recorded by the controller as "via Web/XML".

Who comes for our Danfoss decoys

Our Danfoss decoys are built as AK-SM 800A system managers with the StoreView interface and as the legacy AK-SM 800. They answer the factory login, Supervisor / 12345, and reply to every XML command the way an unpatched unit would. Almost everything that reaches them is the background noise every internet-facing address gets: crawlers, secret-file sweeps and generic probes. The few that were about these controllers came from people at a keyboard:

The successful session, as the decoy recorded it. The XML bodies are written by the page's own script, which follows the real web client; what the visitor chose was the password and the pages to open:

POST /xml.cgi                                     06:48:01  rejected
Content-Type: text/xml
<cmd user="Supervisor" password="123456" lang="English" version="C" action="getauth"></cmd>

POST /xml.cgi                                     06:48:25  accepted
<cmd user="Supervisor" password="12345" lang="English" version="C" action="getauth"></cmd>

POST /xml.cgi                                     06:48:25  home page
Aksm-Auth: Basic <Supervisor:12345, base64>
<cmd lang="English" version="C" action="read_units"></cmd>

POST /xml.cgi                                     06:55:31  configuration page
<cmd isconfigure="1" pnum="0" lang="English" version="C" action="read_list"></cmd>

Two hand-typed attempts with the same factory credentials, days apart, from unrelated networks. On these controllers, the first move we see is a person trying the password printed in the manual.

What to check on your controllers

1. Read the trace log. In Info > Tracage (trace log), look for "(via Web/XML)" entries you did not make against Utilisateurs / Mot de passe or Nom Mag., and for a store name you did not set.
2. Change every password, starting with user 1. Supervisor / 12345 is the factory login in Danfoss guides; it is the pair both of our hand-typed visitors tried. Remove accounts nobody uses.
3. Watch the XML interface. If a proxy or firewall in front of the controller keeps request logs, look for POST /xml.cgi with action="write_list" or action="write_val", and getauth logins as Supervisor, from addresses that are not your maintenance provider's.
4. Take the web interface off the internet. Reach it through a VPN or a protected management network agreed with your refrigeration provider.
5. Update or replace. On the AK-SM 800A, version 4.2 fixes CVE-2025-41450 (the date-derived "code of the day" login) and 4.3.1 fixes CVE-2025-41451 and CVE-2025-41452²³⁴. Danfoss has said the older AK-SM 800 and AK-SC 355 no longer receive security updates⁹: isolate them.
6. If you find a change you did not make, follow CERT-FR's guidance for these incidents: cut the internet exposure, reset to factory settings, reconfigure, and restore access through a secure connection⁷. The incidents have since spread beyond France⁸.

Indicators

References

1. agyx_france, Instagram post with the controller's trace log, 25 October 2026.
2. Danfoss, DSA-2025-03-01: improper authentication in the AK-SM8xxA Series (CVE-2025-41450, fixed in 4.2).
3. Danfoss, DSA-2025-08-01: OS command injection and nginx configuration injection in the AK-SM8xxA Series (CVE-2025-41451 and CVE-2025-41452, fixed in 4.3.1).
4. CISA, ICSA-25-140-03: Danfoss AK-SM 8xxA Series.
5. Danfoss, AK-SM 800AL user guide (first user at Supervisor level by factory default; reset to Supervisor / 12345).
6. Danfoss, AK-SM 850 manual (factory default user name Supervisor, password 12345).
7. The Hacker News, coverage of the CERT-FR alert on refrigeration controllers, October 2026.
8. Facilities Dive, European grocery stores hit with second refrigeration system hack, November 2026.
9. Facilities Dive, Hack of Danfoss refrigeration controllers in Europe causes tens of millions in food losses, October 2026.

Related research

• 4EverAble2Shell is already mining Monero on live N-central servers 2026-11-12
• Inside SOÛL SOCIETY: automated exploitation, AI agent orders and a Telegram drug platform 2026-11-08
• ARTEX learns to spot honeypots: dissecting an AI pentest agent's decoy detector 2026-11-04

Live data

• Live finds: malware, C2 and open directories on the network now
• CVE intelligence: what is being exploited on the decoys