SecurityScorecard says a suspected spam botnet has 9 IPs, 3 confirmed as Copeland XWEB PRO controllers

Nine addresses, three confirmed controllers: the other six are unverified

SecurityScorecard's STRIKE team says it found nine IP addresses sending mail outbound only, in what it calls a suspected SMTP botnet, and that three of the nine are confirmed Dixell/Copeland XWEB PRO refrigeration controllers. That leaves six of the nine unconfirmed (derived: 9 minus 3). The post's own words for the six are "The remaining IPs were unreachable from our egress, so they are unverified." Everything here is as read between 18:31 and 18:50 UTC on Monday 9 November 2026: the post, dated 5 November 2026 by its page data, and the other pages in the sources list.

What that does not establish. It does not establish who runs the botnet. It does not establish how any of the three controllers was compromised: the post says only that "The likely way in is CVE-2026-25085 (CVSS 8.6)". It does not establish that any spam was delivered, or that the activity touched refrigeration. And it does not claim a link to the freezer attacks in Europe: the post says "STRIKE has not linked the October attacks in France or the November 2 attacks across Europe to the activity described in this report". STRIKE grades its own confidence as low to medium.

The flaw the post names was not new when the post appeared. CISA's advisory ICSA-26-057-10 carries an initial release date of 26 February 2026, which is 249 days before STRIKE says it first saw the activity (2 November) and 252 days before the post (both derived). Copeland's own bulletin, headed February 2026, says firmware 1.13 addresses all previously identified vulnerabilities. The post does not print the firmware version of any controller it saw.

One interest, stated once: SecurityScorecard sells security ratings and threat intelligence, and its STRIKE posts are also how it shows that work. Help Net Security (9 November 2026, 14:54 UTC by its page data) is a secondary: it summarises the post and adds a second incident, covered below. This brief leaves out every IP address in the post, and says why in the Technical details section.

What STRIKE says it did, in the post's order

The post works down five steps. The first is why these boxes matter: XWEB PRO is, in the post's description, a supervisory controller for commercial refrigeration, installed above freezer and chiller racks, with a web interface on ports 8015 and 443 for technicians. The post adds that the device is a small Linux computer with a stable address and "no security team, logging, or routine monitoring is in place", which is the post's reason an abuser can use it for weeks or months unnoticed.

Second, scan data. STRIKE started from its Driftnet internet-wide scan data. In the post's words, "The export is a per-host summary: one row per IP with its open ports, product, and banner tags", and filtered it to hosts whose page title or certificate name identifies an XWEB controller. It warns that a substring match on the brand name also pulls in unrelated hosting companies, and says "Filter on the UI title or certificate, not the string." The export is where the figure of six genuine controllers on vulnerable firmware comes from, in a set where only 14 rows mention XWEB.

Third, flow data. Pivoting from the exposed panels, STRIKE describes two controllers it says were repurposed: one as a tunnel gateway, which it says carries 71% of all flows in the capture (the post does not define the capture), and one as a residential proxy or proxyware exit, with 99.6% of its traffic originating from the device and connections to 10,643 distinct peers within 17 hours. The post does not print a separate identity check for these two. They are not among the nine mail senders.

Fourth, the nine senders. STRIKE reports heavy fan-out to ports 25, 465 and 587, flows of about 250 bytes, and no inbound mail, and reasons that a real mail server both sends and receives. That is a statement about the shape of network flows. The post does not say it saw message content, and does not say whether a target is a recipient address or a receiving server.

Fifth, identity. STRIKE says it confirmed device identity by passive reads only, "including a plain HTTPS GET and a certificate grab", and ran no intrusive scans of third party control systems. Three of the nine presented an XWEB certificate name or page title. The other six are the subject of the next section.

Zoom

The post also records three corrections to its own early work, which is to its credit and which readers should know about. A block it first took for operator infrastructure turned out, it says, to be 128 victim devices with an identical fingerprint. A figure of about 2,105 enumerated XWEB devices and a 1,233 node mesh was refined to a generic scrape in which, in the post's words, only 14 rows mention XWEB and six are genuine controllers. A first nine IP list was a false positive from two unrelated mail hosts, and the revised list of nine is stated to be re-verified. The post's lesson is "Labels in the data, such as an ISP name, SMTP banner, or scrape bucket, are leads, not device identities."

The six the post does not confirm, and the three it does

The post's table of senders has a column headed XWEB confirmed. Its entries fall into four groups, shown here without addresses. The nine nodes sit in eight countries (derived from the table's country codes), so the cluster is not one region.

This site's reading of the table, labelled as such: the three senders with printed target counts are the three marked co-present, and the three marked confirmed carry no printed count. The post says the overlap figures are for "The three heaviest share about 47% of their targets (295 in common), and 508 of 1,041 total targets were hit by two or more nodes". Read together, the table indicates that the overlap the post calls its strongest coordination signal was measured on senders the post did not confirm as controllers. The post does not say this in words and does not say whether the overlap would hold for the confirmed three. This site cannot see the underlying flow data.

The post is open about the other half of the picture. It found "we found only two common endpoints with few flows" and says "The coordination evidence is the target-list overlap, but we can't yet point to a controller." So the case for one operator rests on shared targets and not on shared infrastructure.

The overlap arithmetic, recomputed

The two overlap figures in the post use different bases, and the post does not explain the second. The first is across all nine nodes: 508 of 1,041 targets were hit by two or more nodes, which is 48.8 percent (derived), so 533 targets were hit by exactly one node (derived). The second is across the three heaviest: about 47 percent of their target lists, 295 in common.

The post's inference is "Independent spammers would not converge on the same victims by chance, which points to a single coordinated operator." This site's observation, not the post's: the post does not discuss other ways several senders could share targets, such as a common purchased list. Shared targets are evidence of something in common. The post's own grading, low to medium confidence, is the right size for it.

A friendly label doing the work of evidence: refrigerator botnet

The post's title is The Refrigerator Botnet. Its own figure, reproduced below, labels the nine circles of the SMTP cluster as refrigerator IPs. Its text says three of the nine are confirmed controllers and that the six others are unverified. A reader who sees only the figure takes nine refrigerators away. The post itself warns about this habit: "ISP/ASN names the network owner, not the device. It is not evidence of what the box is."

Zoom

What a confirmation by certificate and page title supports, and what it does not. The post says "A faked SMTP banner would not also present a Dixell-issued TLS certificate and the vendor's web UI." That reasoning supports the claim that the address presents a real XWEB interface rather than a look-alike. It does not by itself show that the controller, and not another machine sharing the address, sent the mail; the post does not say how it excludes that, and for two nodes it says the XWEB box sits behind a router. This is a question the post leaves unanswered, not a finding that it is wrong.

A smaller version of the same point is in the key findings, which say attackers are using controllers as proxy exits and spam senders, while the same page calls the botnet suspected. Both appear in the post. The article follows the narrower wording.

The temperature attacks, and the line STRIKE draws

The post opens with the freezer attacks as context. It relays press reports that "hackers remotely raised the temperatures of refrigerators and freezers at supermarkets in at least six European countries", in some cases to 50°C, after "This followed a similar attack in France about three weeks earlier". It then draws a line: "STRIKE has not linked the October attacks in France or the November 2 attacks across Europe to the activity described in this report". It says it includes them as context for why these devices matter. This site's earlier briefs cover those attacks: the French attack and Danfoss's end of life statement, the second wave on 2 November and CISA and the FBI on industrial refrigeration attacks. Nothing read for this brief joins them to the spam activity.

Zoom

Help Net Security adds a second item the STRIKE post does not contain. Ransom-ISAC (6 November 2026 by its page data; an organisation that offers membership and incident support) analysed an event log from an internet-exposed XWEB Pro unit running 1.9.0: on 2 November, two Administrator sessions read settings across 31 devices and then made 743 parameter writes. Its conclusion is "The attackers needed no vulnerability, only the default credentials." It also says "We have no evidence linking it to NoName057(16), Z-Pentest Alliance or the attacks in France." and "The log does not show whether stock was lost." Ransom-ISAC states that in October attackers hit about 700 of France's 10,000 supermarkets through Danfoss, Copeland and Dixell controllers, a statement it attributes to press reports this brief did not read.

Same product class, different behaviour: the Ransom-ISAC incident changed refrigeration settings through the controller's own functions, and the STRIKE activity, as described, is network traffic out of the controller. STRIKE first identified its senders on 2 November, the date of the Ransom-ISAC incident. This site notes the coincidence and draws no conclusion from it: a shared date is not a shared operator, a shared entry method or a shared victim.

Published in February: the vulnerability record

The post names CVE-2026-25085 and says the advisory covers 23 CVEs. The record is older than the post by most of a year. The table gives the dates as each source prints them.

The CISA page's own date element reads 26 February 2026, matching the advisory text, and its revision history shows one revision, the initial publication. Help Net Security also dates the advisory to February. The CISA text says no known public exploitation had been reported to CISA; that sentence belongs to the February release and says nothing about what has happened since.

The counts reconcile: 1 + 1 + 19 + 1 + 1 = 23 (derived), and 21 of them are High or Critical (derived), matching Claroty's own count of 21. The post's side description of the 23, an admin password that can be calculated from the device's MAC address and 19 command injection flaws, matches this list; the MAC address detail is in Claroty's account of CVE-2026-21718, not in CISA's text. Claroty published the research, and its post ends with an invitation to talk to an expert, a commercial interest worth noting once.

What STRIKE states, and what it does not

Where the sources differ

What to do, in order

Technical details

Every block below is copied from the page named in its caption, read 9 November 2026, unless marked derived. The indicators are left out on purpose. The STRIKE post prints its indicators at the end, graded low to medium confidence, and they are internet addresses of compromised or suspected devices, most belonging to organisations that are victims. A list of reachable, vulnerable controllers helps the next attacker more than it helps a defender, and the post is the right place for them. This brief gives the indicator types and counts instead, and no scan query for finding exposed controllers, and no exploit steps.

The detection signal STRIKE prints. It is a description of network flow behaviour, not a search string for the internet. A defender runs it on their own flow logs for the subnet that holds refrigeration controllers: look for outbound connections to the three mail ports and for the absence of inbound mail.

STRIKE observed heavy fan-out to ports 25 / 465 / 587, tiny flows of about 250 bytes, and no inbound mail.
An exposed XWEB banner plus outbound :25/465/587 fan-out with no inbound mail is a moderate-confidence compromise signal.
Filter on the UI title or certificate, not the string.

What the advisory prints for the CVE the post names, and the affected products. This is what a defender compares against the version shown on their own controller. The record says versions up to and including 1.12.1 are affected.

Copeland XWEB 300D PRO: <=1.12.1, Copeland XWEB 500D PRO: <=1.12.1, Copeland XWEB 500B PRO: <=1.12.1
A vulnerability exists in Copeland XWEB Pro version 1.12.1 and prior, in which an unexpected return value from the authentication routine is later on processed as a legitimate value, resulting in an authentication bypass.
Relevant CWE: CWE-394 Unexpected Status Code or Return Value
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Initial Release Date: 2026-02-26

How the two public records score the same CVE, and when. This site derived the layout; the values are copied from fields. The CISA-ADP entry is a CISA enrichment, not the vendor's score.

CVE.org record: CVE-2026-25085, state PUBLISHED, assigner icscert
  dateReserved 2026-02-05T19:05:16.849Z, datePublished 2026-02-27T00:33:06.657Z
  CNA CVSS 3.1: 8.6 HIGH, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L, CWE-394
  CISA-ADP SSVC (CISA Coordinator, 2026-03-02): Exploitation none, Automatable yes, Technical Impact partial
NVD record: published 2026-02-27T01:16:19.367, status Analyzed
  nvd@nist.gov (Primary): 9.8 CRITICAL, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  ics-cert@hq.dhs.gov (Secondary): 8.6 HIGH

What the vendor's own bulletin says to do. The bulletin names firmware 1.13 as the fix and lists network hardening steps that bear directly on the spam signal: restricting communications to and from the control system.

The firmware version 1.13 addresses and provides mitigation for all previously identified security vulnerabilities.
never exposing the control system to the broader Internet;
configuring your network to restrict inbound and outbound communications to and from the control system;
ensuring default account passwords are updated and all passwords align with industry best practices;

The indicators STRIKE publishes, by type and grade. Counted by this site from the appendix; the addresses themselves are not reproduced. Treat them, as STRIKE says, as victims or abused infrastructure and not as adversary owned assets.

STRIKE appendix, counted (derived by this site):
  14 indicator rows: 11 IPv4 addresses and 3 IP and port pairs.
  Confidence column: Medium 5, Low to Med 7, Low 2.
  Types named in the context column: XWEB panel repurposed as tunnel gateway; XWEB panel repurposed as residential proxy exit;
  SMTP spam nodes (nine); weak shared endpoints across spam nodes (possible C2, graded Low).
Addresses omitted. They are in the STRIKE post.

STRIKE's own caveat, copied, because it governs how any of the above is used.

STRIKE's overall confidence is low to medium. Device behavior and the SMTP coordination are well supported, but full device attribution and the C2 picture are still under investigation.
When taking action, treat these IPs as victims or abused infrastructure, not as adversary-owned assets.

The question the post leaves open

STRIKE confirms three controllers, says the overlap among the three heaviest senders is its strongest sign of one operator, and prints target counts only for senders it did not confirm as controllers. Of the nine addresses, which sent the most mail, and is that one a refrigeration controller?

Key facts