Cybersecurity researchers at Forescout are drawing attention to the risks posed by exposed refrigeration control systems, warning that weaknesses in operational technology (OT) could have serious consequences for food supplies, business continuity and other temperature-sensitive operations.
The warning comes following cyberattacks against French supermarkets in October 2026, which reportedly disrupted refrigeration systems at hundreds of stores. Attackers were able to interfere with cooling operations, resulting in temperature fluctuations, spoiled stock and significant disruption.
The incidents have raised concerns about the security of internet-connected refrigeration equipment, particularly where older systems, exposed management interfaces and inadequate access controls leave operational technology vulnerable to interference.
Unlike conventional IT attacks, which frequently focus on stealing data or disrupting digital services, attacks against refrigeration controllers can directly affect physical processes.
These systems are responsible for maintaining temperatures across supermarkets, food storage facilities and other environments where consistent cooling is essential.
If attackers gain sufficient access, they may be able to manipulate temperature settings, interfere with defrost cycles or disrupt equipment operations. The consequences can extend beyond IT downtime to include damaged stock, financial losses and potential safety risks.
The issue also extends beyond food retail. Refrigeration and temperature-control systems are used in healthcare, pharmaceuticals, manufacturing and logistics, making their security an important consideration across several industries.
One of the central concerns is the accessibility of operational technology that was not originally designed to withstand direct exposure to the internet.
Remote management capabilities allow engineers and third-party maintenance providers to monitor and adjust refrigeration equipment without visiting individual sites. However, these connections can introduce security weaknesses if they are poorly configured or inadequately protected.
Research into industrial control systems has identified publicly accessible management interfaces, outdated firmware and weak authentication as recurring problems.
In some cases, organisations may not have complete visibility of the equipment connected to their networks, particularly where systems have been installed and maintained by external contractors.
New research from Forescout’s Vedere Labs has identified 12,976 internet-exposed service observations across ten product groups, associated with 6,017 distinct public IP addresses in 99 countries and territories.
The findings suggest that the weaknesses highlighted by the French supermarket attacks are part of a much wider global problem.
The largest number of observations involved Copeland/Dixell XWEB services, with 7,075 recorded, followed by 4,697 Danfoss StoreView services. Researchers also identified 551 Copeland Site Supervisor services, 513 Carel pCOWeb services and 140 observations across six other product groups.
Importantly, these figures represent exposed services rather than confirmed compromised devices. A single IP address may host multiple services, while one management interface may control several downstream systems.
The researchers also found that 3,762 Danfoss StoreView service observations, representing 80% of the total, were running firmware older than version 4.3.1, making them potentially vulnerable to two previously disclosed security flaws.
Forescout’s research suggests that attacks against refrigeration systems are not a new development.
According to a technical bulletin published by Danfoss, hacktivist attacks in 2022 affected 16 Russian supermarkets and 40 stores in Israel.
Forescout has also tracked more than 20 claimed attacks against refrigeration systems since January 2026, with pro-Russian hacktivist groups Z-Pentest Alliance and NoName057(16) among the most active.
Targets have included supermarkets, wineries, fruit storage facilities and agricultural businesses across Europe.
However, the researchers stress that the initial access methods and identities of those responsible for the recent French attacks have not been confirmed.
Forescout is urging organisations to review how refrigeration management systems are connected to the internet and who is authorised to access them.
Recommendations include removing publicly accessible management interfaces, replacing unsupported equipment, applying available security updates and introducing secure remote access for maintenance contractors.
The researchers also recommend multifactor authentication, individual user accounts and continuous monitoring to identify suspicious changes to temperature settings, defrost schedules and alarms.
The challenge is that attackers do not necessarily need to deploy malware to cause disruption. Once they gain sufficient access, they may be able to misuse legitimate management functions, making malicious activity harder to distinguish from routine maintenance.
The research highlights a broader issue for operational technology security: organisations need visibility not only of connected devices, but also of who can access them, what changes they can make and how those changes affect physical operations.
Read the full research here: Cold Chain, Open Control: Exposed Refrigeration Systems Reveal Global Risk
The post Exposed Refrigeration Systems Raise Global Cybersecurity Concerns appeared first on IT Security Guru.
Forescout has expanded its investment in its global partner ecosystem to strengthen technical expertise and help partners support customers managing increasingly complex IT, OT, IoT, and IoMT environments.
Nearly 100% of Forescout’s customer business is transacted through partners, making the channel a central part of the cybersecurity company’s growth strategy. Its latest investment includes the ongoing Mission: Possible enablement roadshow and the continued support of several partners in its Envision Partner Program.
Launched in May, Mission:Possible represents the largest investment in channel engagement in Forescout’s history.
The programme is targeting 90 cities across more than 40 countries, with content available in 22 languages. More than 1,300 people have attended events so far, with Forescout expecting to engage over 2,000 partner professionals by the end of September.
Through technical education, hands-on discussions and local engagement, the programme is designed to give partners the expertise needed to help customers address emerging risks, including those associated with frontier AI and complex cyber-physical environments.
Forescout has also recognised several organisations that have reached new levels within its Envision Partner Program.
TIC Defense has advanced from Authorised Training Partner to Silver Reseller, while Trace3, Upstart Cyber and Sidif have moved from Silver to Gold Reseller status.
NTT Australia, Hitachi Sunway Information Systems Malaysia, DOR Information Technologies Israel and Computacenter Germany have all progressed from Gold to Platinum Reseller.
David Creed, Vice President of Worldwide Channel Sales at Forescout, said the company is continuing to raise expectations around technical capability, certifications, customer success and business performance.
“We’re proud to recognise these partners who have demonstrated exceptional commitment to customer success, technical excellence, partner enablement, and business growth while helping organisations meaningfully reduce cyber risk across converged IT, OT, IoT and IoMT environments,” he said.
Milo Sanchez, Senior Practice Director at Trace3, said Forescout’s technical investment and collaborative approach had helped the company better support its clients and grow the partnership.
Forescout said partners are playing a growing role in helping organisations improve visibility and respond to threats across connected environments.
According to the company, organisations using its technology have reported discovering 50% more unknown IoT devices and reducing median breach containment time by 98.7%. The average time required to identify unknown, unmanaged and unauthorised assets has also fallen from 41 hours to six minutes.
The company’s channel programme has also received industry recognition, with the Envision Partner Program included in CRN’s Partner Program Guide and Forescout executives recognised in CRN’s Channel Chiefs and Channel Leaders EMEA lists.
The post Forescout Expands Global Investment in Channel Partners appeared first on IT Security Guru.
New research from Forescout’s Vedere Labs has demonstrated how artificial intelligence could begin to lower the barriers to developing sophisticated cyberattacks against industrial systems.
The research set out to answer a potentially important question for operational technology (OT) security: can AI successfully adapt a remote code execution (RCE) exploit developed for one programmable logic controller (PLC) so that it works against another?
Researchers tested this by using AI to help port an existing RCE exploit between two WAGO PLC models. The experiment was ultimately successful, demonstrating that AI can assist with highly specialised exploit development in embedded environments.
However, the results also showed that AI is not yet capable of doing this independently.
Throughout the experiment, researchers had to guide the AI through false leads, incorrect assumptions and technical dead ends.
Developing the final exploit took eight hours and 32 minutes and consumed $535.74 in API tokens, highlighting the cost and human involvement still required.
Once reliable code execution had been achieved, however, the process accelerated considerably. AI was able to produce multiple working network payloads within minutes.
This difference is important. While AI may still struggle with the most complex stages of exploit development, it could rapidly automate subsequent stages once the initial technical barriers have been overcome.
The experiment also demonstrated the risks of allowing AI to operate against physical technology. When researchers attempted to develop a command-and-control implant, the PLC was permanently bricked.
What happens as AI improves?
The findings raise wider questions about the future security of industrial and critical infrastructure.
PLC exploitation requires specialist knowledge of hardware, firmware, architectures and industrial protocols, creating a relatively high technical barrier for attackers. AI could gradually begin to reduce that barrier.
As models become more capable, the time, expertise and cost required to adapt an existing exploit across families of related industrial devices could fall significantly.
That could also change how organisations assess vulnerabilities. A weakness considered difficult or expensive to exploit today may become considerably more accessible as AI-assisted offensive capabilities improve.
For critical infrastructure operators, the bigger question is therefore not whether AI can autonomously develop sophisticated PLC attacks today. Forescout’s experiment shows that it cannot yet do so reliably.
Instead, organisations need to consider what happens when increasingly autonomous exploit development meets large numbers of exposed industrial devices and the technical barriers protecting them begin to disappear.
Read the full Forescout Vedere Labs research here.
The post Forescout Research Tests Whether AI Can Create PLC Attacks appeared first on IT Security Guru.
The Forescout 2026 H1 Threat Review found that more than 37,000 vulnerabilities were published during the first six months of the year, representing a 51% increase year on year. More than half were classified as high or critical severity, while ransomware attack claims rose by 25% to 4,544 incidents, averaging 25 attacks every day.
The report, published by Forescout Research – Vedere Labs, analysed more than 37,000 vulnerabilities, over 1,000 tracked threat actors and thousands of cyberattacks observed between January and June 2026. Researchers found that rapid advances in AI, alongside growing geopolitical tensions, are increasing the pressure on security teams already struggling to prioritise risk.
Among the report‘s key findings, researchers discovered that nearly half of all additions to CISA’s Known Exploited Vulnerabilities (KEV) catalogue related to vulnerabilities published before 2026, reinforcing the continued risk posed by older, unpatched flaws. The number of active ransomware groups also increased to 103, while China, Russia and Iran collectively accounted for almost a third of tracked threat actors with significant activity during the reporting period.
The research also highlights the growing use of AI by threat actors to accelerate attacks, alongside increasingly sophisticated software supply chain compromises. At the same time, attackers continue to focus on network infrastructure, operational technology, IoT and IoMT devices, many of which receive less security oversight than traditional endpoints.
“AI is dramatically increasing the speed and scale of cyberattacks,” said Daniel dos Santos, VP of Research at Forescout.
“In observing attack patterns and threat actor activity, we can see that AI is helping threat actors discover and exploit vulnerabilities faster than security teams can realistically remediate them. At the same time, geopolitical conflicts are fuelling waves of opportunistic and state-aligned cyber activity, with organisations in critical infrastructure sectors increasingly at risk.”
He added that organisations need a better understanding of the assets connected to their networks so they can prioritise risk and contain threats before attackers can move laterally into critical systems.
The report also examines the evolution of Iranian cyber operations, noting that the distinction between state-sponsored actors, hacktivist groups and cybercriminal organisations is becoming increasingly blurred. Researchers found these groups are using a mix of espionage campaigns, ransomware and attacks targeting critical infrastructure and operational technology.
Barry Mainz, CEO of Forescout, said organisations must extend their focus beyond traditional endpoints to address unmanaged assets and connected devices.
“As attack surfaces continue to expand, security teams can no longer focus exclusively on traditional endpoints,” he said.
“Many organisations still have significant blind spots across unmanaged assets and IoT, OT, and IoMT devices. Threat actors understand this and are increasingly exploiting those gaps.”
The report recommends that organisations should continuously identify vulnerable assets, strengthen network segmentation, prioritise the highest-risk systems and accelerate response capabilities to reduce exposure across increasingly complex environments.
The post Forescout Report Reveals Surge in AI-Driven Cyber Threats appeared first on IT Security Guru.
Login