Copeland XWEB controllers hijacked for spam and proxy traffic
Original title: Hackers abuse refrigeration controllers to send spam and route proxy traffic
SecurityScorecard linked three XWEB PRO units to coordinated outbound spam and only suspects CVE-2026-25085.
SecurityScorecard says internet-exposed Copeland XWEB PRO refrigeration controllers are being used to send spam and act as proxies. Three confirmed panels shared many email targets, which the firm reads as one operator, though command-and-control evidence is weak. A separate Ransom-ISAC case on November 2 used factory Administrator credentials to push setpoints to 110°C and 150°C. SecurityScorecard has not tied the botnet to European supermarket or blood-bank incidents.
Unconfirmed: Entry via CVE-2026-25085 is a low-to-medium-confidence belief, and neither the botnet nor group claims are confirmed as linked to the European incidents.
- Nine IPs sent mail and received none; three were confirmed XWEB controllers.
- A Namibia unit carried 71% of captured traffic as a tunnel gateway.
- A Trinidad and Tobago controller contacted 10,643 hosts in 17 hours.
- Ransom-ISAC logged 743 setting changes across 31 devices.
- NoName057(16) and Z-Pentest claimed supermarket attacks; that claim is unconfirmed.
Impact: spam sending, proxy use, and unsafe temperature setpoints
| Product | Affected |
|---|---|
| Copeland XWEB PRO | — |
- 1.Treat the listed controller IPs as abused victim infrastructure, not attacker-owned assets.
- 2.Change factory Administrator logins on internet-exposed XWEB controllers.
- 3.Install available controller updates where remote managers have not.
- CVEs
- CVE-2026-25085
- Products
- XWEB PRO
- Threat actors
- NoName057(16)Z-Pentest
- Victims
- French Blood Establishment
- Organizations
- SecurityScorecardRansom-ISACCISAClaroty
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-25085 | A vulnerability exists in Copeland XWEB Pro version 1.12.1 and prior, in which an unexpected return value from the authentication routine is later on processed… | 9.8 | <1% |
From the original article
4 min read at helpnetsecurity.com
Internet-exposed refrigeration controllers used in supermarkets and cold storage facilities are being hijacked and turned into infrastructure for a suspected spam botnet and proxy services, SecurityScorecard has found.
By Sinisa Markovic · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.