“The barrier of entry for these attacks is so low that it doesn't take someone, even a computer person, to pull it off. The technique doesn't require malware, doesn't require any secrecy or any special technologies. It's a trick to get in and tamper with it. So it's not even really hacking.”
CyberWire Daily · Software Engineering & Infra · November 2026
Context
Asked what is going on with the attacks on refrigeration controllers in Europe, Grove said the threat actor is still unknown. Although the campaign looks coordinated, the low skill needed means it could be a nation state, hacktivists or anyone else.
Transcript
…this in-house. They have their own operations, but many of them, the not largest, the mid and smaller markets, they don't. They need to work with system integrators. And those system integrators can't send people out to take their meter readings every day. And therefore, they deploy remote access.
Well, help us understand what we're dealing with here. I mean, in terms of what you've seen from the reports, but then also, of course, your insights from you and your colleagues at Nozomi. What's going on here?
TBD. We are still trying to determine exactly what's going on. We see the impact, but we don't know the threat actor yet. There's some suspicion around who's behind these. But until we really know that, it's very hard to determine why this is happening. We do know that it seems very targeted, very coordinated. And typically, these types of operations will lead to nation state involvement. Except the barrier of entry for these attacks is so low that it doesn't take someone, even a computer person, to pull it off. The technique to do this doesn't require malware, doesn't require any secrecy or any special technologies. It's a trick to get in and tamper with it. So it's not even really hacking. These are opportunistic attacks and targeting of these types of systems really seems to be confined to a certain region, a certain type of device. And it could be anyone. It could be a nation state. It could be an angry hacktivist group. It could be someone who wants to enhance their negotiating position by expressing a capability that they have. It could be a variety of different…
Can you help us understand the technical part of it? You mentioned there's a trick that's being taken advantage of here. What's the weakness that these systems have?
It's basically a way to use the date to predict a password. So imagine something has a password that's easily guessed. That's, well, there's actually multiple things in play here. First of all, there's the techniques to do it, but the attacks have not been directly tied to any one of a group of…
In terms of protecting critical infrastructure, to what degree do we take this seriously? How much is this a cautionary tale for other verticals?
More from CyberWire Daily
