A new cold war: hackers target fridges across the globe
It was a May morning in Israel when employees at a large food production plant watched in horror as the office printers started spontaneously spitting out reams of threatening messages.
uncertain
printers → target → messages
Then, employees found malicious code on corporate computers designed to wipe away internal data.
asserted
employees → find → data
Finally, an engineer smelled smoke coming out of the industrial freezers, only to find broken compressors and badly spoiled food inside.
asserted
engineer → smell → compressors
The company's operations ground to a halt for over a week while engineers waited for new parts to arrive from abroad.
asserted
parts → grind → week
It was all the result of a targeted, multi-pronged cyberattack.
asserted
It → target → cyberattack
"I do a lot of cyber incidents, but this is the kind of incident that I know will leave a mark on the people in charge," said Omri Segev Moyal, head of an Israeli incident response firm called Profero, which responded to the attack.
asserted
which → do → attack
Based on forensic data and direct claims from the culprits, Moyal is confident Iranian military hackers who currently go by the name Cyber Isnaad Front, the same group linked to influence campaigns targeting U.S. elections in 2024, are behind the attack on the refrigeration systems.
uncertain
who → base → systems
It was a destructive digital strike that took place during the waning days of a ceasefire between Iran and Israel when tensions were ratcheting up.
asserted
tensions → take → Iran
In the months since, it appears to have become a trend.
asserted
it → appear → months
Still unidentified hackers have targeted refrigeration controllers around the world.
asserted
hackers → target → world
They have spoiled fresh produce and cost businesses time and money.
asserted
They → spoil → time
These attacks have taken place on U.S. military bases in August, French supermarkets in October, and at food stores from small markets to big box stores like IKEA in countries including Sweden, Estonia, Ireland, Luxembourg, the Netherlands, and Belgium in early November.
asserted
attacks → take → November
"We're observing targeted attacks gradually built and practiced against Israel, tested in Europe and the U.S., and unleashed [now]," Moyal said in an interview with NPR.
asserted
Moyal → observe → NPR
Across the globe, bad actors with access to AI are breaking into and taking control of the aging machines that run global critical infrastructure, from water pumps to cooling systems.
asserted
that → break → systems
That should put pressure on governments and companies to find solutions to long-standing security challenges before things get even worse, cybersecurity experts say.
asserted
experts → put → challenges
"With great connectivity comes great responsibility," said Josh Corman, a former cybersecurity official with the Cybersecurity and Infrastructure Security Agency who specializes in public safety.
asserted
who → come → safety
"As we connect industrial refrigeration to the Internet, we expose it to accidents and adversaries," Corman continued.
asserted
Corman → connect → accidents
"While these [attacks] hit food," he said, the next ones could go after "temperature sensitive drugs and laboratory materials."
uncertain
ones → hit → drugs
Origins in Israel
As early as March, hackers appear to have targeted a small chain of kosher grocery stores in Israel, according to avideo posted to social media.
uncertain
hackers → appear → media
In the video, a customer is touching previously frozen food including soft, squishy packages of meat that have clearly spoiled.
asserted
that → touch → meat
The company did not immediately respond to a request for comment about the incident.
asserted
company → respond → incident
A couple months later, hackers went after a bigger target in the food production plant and its associated businesses, the incident Profero was called in to respond to.
asserted
Profero → go → plant
Moyal declined to share the name of the company due to client confidentiality, but described further details about the incident to NPR.
asserted
Moyal → decline → NPR
The hackers broke into the industrial controllers that helped manage and monitor the freezers.
asserted
that → break → freezers
They also adjusted the safety limits, opened the gas pressure valves, changed the credentials, disabled alerts, and destroyed forensic evidence in the middle of the night.
asserted
They → adjust → night
They took advantage of the vulnerable devices as well as the laws of thermodynamics to render the compressors "eliminated," Moyal said.
asserted
Moyal → take → thermodynamics
"They were blown up … not like C4 exploding, but they got overused and there was smoke.
asserted
they → blow → ?
"
The technical sophistication of these attacks is advancing, in part thanks to AI, Moyal added.
asserted
Moyal → advance → AI
"What we were able to see is they very rapidly were able to, almost like magic, go from initially playing with the system to fully understanding how the configuration works," Moyal said.
asserted
Moyal → see → system
"They tried the simple things … and then they started to bombard the system with different types of configurations until they destroyed the compressor.
asserted
they → try → compressor
It wasn't human, the amount of configurations they were able to try in a short time span.
asserted
they → try → span
"
Replacing parts and recovering from the attack were costly, in time and money, Moyal added.
asserted
Moyal → replace → time
But the hackers didn't stop there.
asserted
hackers → stop → ?
A propaganda video about the Israeli grocery store hack was released in October.
asserted
video → release → October
While it was largely wiped from the internet, it was shared with NPR on the condition that the identity of Moyal's client wouldn't be revealed.
asserted
identity → wipe → client
NPR is choosing not to publish it for that reason and not to aid in the spread of propaganda.
asserted
NPR → choose → propaganda
That video suggests stoking fear was part of the hackers' motivation.
uncertain
stoking → suggest → motivation
In the video, labeled with a glowing red triangle embossed with the "Cyber Isnaad Front" logo, a masked man sits in a room full of digital screens, typing away on a keyboard before revealing hacked surveillance footage of customers across Israel in supermarkets that were affected by the large-scale destruction, as well as employees at the company finding the printed propaganda materials.
asserted
employees → label → materials
In Arabic, the hackers claim to have launched the attack on behalf of the starving children of Gaza, closing out with the hacker saluting French students in French, likely a reference to ongoing riots in France over education.
uncertain
hacker → claim → education
It's unclear why the video references French students, though the group has impersonated a French far-right group in the past and targeted the Israeli delegation to the 2024 Paris Olympics.
uncertain
group → reference → Olympics
…and 71 more, not listed.
The Aporia
