- Published
Two Russian hacktivist groups have claimed they worked together on the waves of freezer hacks which have affected European supermarkets.
asserted
which → publish → supermarkets
Noname057(16) and Z-Pentest Alliance posted on Telegram that they were responsible, bragging that they had "once again demonstrated a high level of skill and precision".
But their posts and channels have now been deleted and their claims are being met with some scepticism.
Cyber-security researchers at multiple firms are pouring over evidence gathered from so-called "honeypots" to provide clues as to who is behind the waves of freezer hacks.
While Russian groups are not being ruled out, experts say Iranian hacktivists or nation state hackers - or even teenagers pulling pranks - could also be the culprits.
uncertain
hacktivists → post → pranks
Three separate cyber-security firms have deployed fake freezer software traps to monitor how hackers attempt to use them for attacks.
asserted
hackers → deploy → attacks
In cyber-security, a "honeypot" is a digital decoy - such as a fake computer network or file - deliberately set up to look like a vulnerable target to lure and trap hackers.
asserted
honeypot → set → hackers
By monitoring these traps, security experts can safely study an attacker's methods without putting real systems at risk.
asserted
experts → monitor → risk
According to activity gathered after the first wave of cyber-attacks, the second wave which hit several European countries was highly targeted.
uncertain
which → accord → countries
"The fact that all these fridge freezers were hit simultaneously suggests planning and coordination," says Ryan Dewhurst from Spanish cyber-security company Previdian.
uncertain
Dewhurst → hit → Previdian
The entry point to the affected freezer software products was not difficult to exploit as they were poorly protected, with known attack methods already floating around online.
asserted
methods → exploit → products
But experts like Dewhurst say the hacker or hackers had to gather the information about the devices' public IP addresses to create a target list then take time to plan which methods to use and when to execute them.
asserted
hacker → say → them
"Given the reported timing of when the devices had their temperatures increased, which seems to have been overnight for maximum damage - this is further evidence that the attack was planned and co-ordinated," he said.
asserted
he → give → damage
Another cyber firm which has deployed similar honeypot tech to lure the hackers into revealing their tactics is Strathclyde-based Lupovis.
asserted
which → deploy → tactics
It had honeypots which appeared to be located around the world, and started seeing activity 10 days before the second wave of cyber-attacks.
asserted
which → have → attacks
Intriguingly, the team saw hackers scanning and probing their fake freezer sites only in Europe.
asserted
hackers → see → Europe
"We saw none of our honeypots in places like Africa or South America targeted at all," said Lupovis founder Dr Xavier Bellekens.
asserted
Bellekens → see → Africa
"Even pots in Ukraine were left alone.
asserted
pots → leave → Ukraine
"
'Hybrid warfare' claim
A third company - French cyber-defence firm Sequoia - also noticed scanning activity prior to the second wave of cyber-attacks, but said it could have been automatic scanning without malicious intent.
uncertain
it → notice → intent
In a report to its customers, it said evidence suggested the nature of the attack aligned with activity of Russian hacktivists or the Russian government, which is being accused of carrying out so-called "hybrid warfare" cyber-attacks across Europe.
uncertain
which → say → Europe
But Sequoia's research also points to Iranian regime hackers or hacktivists too.
asserted
research → point → hackers
"Iranian-aligned actors have an established record of targeting internet-exposed industrial control systems and previous incidents involved the same equipment in Israel and the US - both adversaries of Iran," the report said.
asserted
report → align → Iran
According to Sequoia, about 40 Israeli supermarkets running Danfoss controllers were compromised back in 2022.
uncertain
supermarkets → accord → 2022
Meanwhile in late August, freezers in at least six US military bases were forced into defrost mode, as in France.
asserted
freezers → force → France
The controller models remain unconfirmed and investigations are ongoing.
uncertain
investigations → remain → ?
In a now deleted post online, NoName and Z-Pentest Alliance claim to have targeted freezer software maker Danfoss since the start of 2026.
uncertain
NoName → delete → 2026
And a cyber-security content creator who shared the hacktivist's claims on X said they were "not convinced it was them".
uncertain
it → share → X
"Instead, they may be claiming the activity after analysts posted it could be them," they said.
uncertain
they → claim → activity
Authorities in several countries are actively investigating the hacks and warning supermarkets about potential future attacks.
asserted
Authorities → investigate → attacks
But no formal attribution has been made.
asserted
attribution → make → ?
None of the three cyber firms which have been gathering honey pot data are ruling out that it could be a teenager.
uncertain
it → gather → data
But with the degree of planning necessary the experts all agree it would have to be a well co-ordinated group - and if so, they would expect online bragging to surface soon.
asserted
bragging → agree → planning
The Aporia
