Experts question pro-Russian groups’ claim to cooling-system hacks

Two pro-Russian hacker groups have claimed responsibility for attacks on refrigeration systems in several European countries, but a cybersecurity consultant says the available evidence does not point to them. DR reports that the attacks left food in shops without proper cooling.

Jeppe Engell, a cybersecurity chief consultant at the Confederation of Danish Industry, said the groups’ description of the attacks did not match what is known about how they happened. He said this did not rule out involvement by pro-Russian or Russian actors, but there was no indication that these two groups were responsible.

In a video posted to a Telegram channel claiming to be the official channel of NoName057(16), the group says it carried out the attacks with another pro-Russian group, Z-Pentest. The video, titled “Operation Chronicle: Danfoss”, claims the hackers struck Danfoss and Dixell XWEB equipment.

Engell said the attack on Danfoss involved two vulnerabilities in refrigeration equipment, rather than employee login details. DR Verificerer obtained a list of more than 150 email addresses said to belong to Danfoss employees, but Engell said the addresses were unrelated to the attack. He also said information gathered by security providers involved in Denmark, Norway and other countries did not suggest the groups had carried it out.

Danfoss told DR it had no indication of a successful attack on its internal IT infrastructure or of a data breach. The company said it could not confirm the specific information published by the hacker groups and would not speculate about who was responsible. NoName057(16) had not responded to DR’s request for evidence at the time of publication.

The Danish Agency for Societal Safety said it was too early to determine whether the groups had been involved. It said pro-Russian hacker groups regularly claim responsibility for cyberattacks and use their communications to attract attention, which can itself create insecurity.

Defence Minister Jeppe Bruus said there was suspicion of Russian involvement, and that intelligence indicated Russia was increasing sabotage and cyberattacks in several European countries. Russian government spokesman Dmitry Peskov called the accusations of Russian involvement “absurd” at a press briefing on Thursday.