The French government said that refrigeration equipment used by medical institutions to store donated blood was recently affected by a cyber attack by unknown hackers.
The French Blood Agency (EFS) pointed out that the cold storage storing blood was hacked and the temperature was raised, but staff intervened in time to protect the blood supply.
"No health effects have been detected and no blood products have been lost," the EFS said. So far, only supermarkets are known to be affected by this type of attack.
Meanwhile, reports are circulating online that a Russian hacktivist group claims they have teamed up to breach one of the systems used in the attacks affecting European supermarkets.
Noname057(16) and Z-Pentest Alliance posted that they successfully hacked into Danfoss, sparking speculation that they were behind the hack of the refrigeration equipment.
But analysts are now questioning whether that means they were also behind supermarket cyberattacks. While a Russian group has not been ruled out, experts say Iranian hacking groups or state-level hackers, or even just teenage pranksters, could be behind the attack.
Researchers from several security companies are carefully analyzing evidence collected from so-called "honeypots" in an attempt to identify the person behind the wave of hacks on refrigerated equipment.
Three different cybersecurity companies deployed fake cold storage device software traps to monitor how hackers tried to exploit them. In the field of cybersecurity, a "honeypot" is a type of digital decoy, such as a fake computer network or file deliberately set up to look like a vulnerable target, to lure and capture hackers.
By monitoring these traps, security experts can safely study attacker methods without putting real systems at risk.
The second wave of attacks affecting multiple European countries is highly targeted, according to activity collected after the first wave of cyberattacks.
In this regard, Ryan Dewhurst of Spanish cybersecurity company Previdian said: "These cold storage equipment were attacked at the same time, showing that the attack was planned and coordinated."
Intrusion points into the affected refrigeration equipment software products are not difficult to exploit because protection measures are weak and known attack techniques have long been circulated on the Internet. But, experts like Dewhurst point out, hackers must first collect a device's public IP addresses to build a target list, and then take the time to plan which methods to use and when to execute them.
"Based on the reports, it appears that the temperature of the equipment was increased at night to cause maximum damage, which is further evidence that the attack was planned and coordinated," Dewhurst explained.
Another security company deploying honeypot-like technology to lure hackers into revealing their tactics is Strathclyde-based Lupovis.
The company's honeypots appear to be distributed around the world, and activity was detected 10 days before the second wave of cyberattacks.
Intriguingly, the team found that the hackers only scanned and probed their fake freezer sites in Europe.
"Our honeypots in places like Africa or South America are not targeted at all," said Dr. Xavier Bellekens, founder of Lupovis.
"Even the honeypots in Ukraine are ignored."
'Hybrid warfare' accusations
A third company, French cyber defense company Sekoia, also noticed scanning activity before the second wave of attacks, but said it was likely automated scans that were not malicious.
In a note to clients, the company said evidence showed the nature of the attack was consistent with activity by a Russian hacker group or the Russian government, which has been accused of conducting so-called "hybrid warfare" cyberattacks in Europe.
However, Sekoia's research also points to Iranian regime hackers or groups of hackers.
"Iran-aligned actors have an established track record of targeting industrial control systems exposed online, with previous incidents involving the same equipment from Israel and the United States - both adversaries of Iran," the report states.
According to Sekoia, approximately 40 Israeli supermarkets using Denfoss controllers were compromised in 2022.
At the same time, at the end of August this year, refrigeration equipment at at least six US military bases was forced into defrost mode, the situation was similar to France. The controller model has not been confirmed and the investigation is ongoing.
"To date, we have no technical evidence that Russian-speaking groups are involved," a Sekoia spokesperson told the BBC. "Furthermore, as NoName057 is not known to be effective in carrying out operations other than DDoS attacks and has a history of false attribution, we are skeptical of their claims of responsibility."
A Distributed Denial of Service (DDoS) attack floods a website or online service with large amounts of network traffic in an attempt to make it offline or inaccessible.
None of the three security companies that collected the honeypot data ruled out the possibility that teenagers were responsible. But experts agree that given the level of planning required, it has to be a well-coordinated group; if so, they expect online bragging will soon follow.
