Russian hacktivists claim responsibility for freezer hacks, but experts are skeptical

Hacktivists' claim and experts' skepticism

Two Russian hacktivist groups — NoName057(16) and Z-Pentest Alliance — claimed on Telegram that they jointly stood behind the waves of freezer hacks that affected European supermarkets, boasting that they had 'once again demonstrated a high level of skill and precision'. However, as BBC News reports, their posts and channels were deleted, and the claims are met with skepticism: a cybersecurity writer who reposted the statement on X said he is 'not convinced it was them', suggesting that the groups may have claimed credit for the activity only after analysts pointed to them as possible perpetrators. There is no official attribution yet; authorities in several countries are investigating and warning supermarkets about possible new attacks.

What the honeypots showed: the attack was planned

Three cyber firms deployed honeypots — digital decoys mimicking vulnerable freezer software — to safely study attackers' methods. The data shows that the second wave of attacks, which affected several European countries, was targeted. Ryan Dewhurst of the Spanish company Previdian noted that the simultaneous compromise of all refrigerators points to planning and coordination: the entry point was poorly secured and known attack methods were already circulating online, but the attacker still had to compile a list of public IP addresses of the devices and choose the moment. According to him, the devices' temperature was reportedly raised at night — 'for maximum damage' — which also points to preparation.

Geography of the attacks and theories about the trail

The Scottish firm Lupovis recorded activity on its honeypots 10 days before the second wave, and only European decoys were scanned: 'even the traps in Ukraine remained untouched', said the company's founder Xavier Bellekens. The French firm Sequoia also noticed scanning before the second wave, but allows that it could have been automatic and without malicious intent. In a report to clients, the firm stated that the nature of the attack matches the activity of Russian hacktivists or the Russian state, which is accused of 'hybrid' cyberattacks across Europe, but it also points to an Iranian trail: Iran-oriented groups have experience attacking exposed industrial control systems, and in 2022 about 40 Israeli supermarkets with Danfoss controllers were compromised. At the end of August, freezers at at least six US military bases were switched into defrost mode — the controller models there have not been confirmed, and the investigation is ongoing.

Whoever it is — it's a group

None of the three firms rules out that a mischievous teenager could be behind the attacks. However, in the experts' shared view, given the amount of preparation required, the perpetrator must be a well-coordinated group — and then, presumably, boastful posts will soon appear online. For now, the deleted claims by the Russian groups remain merely an assertion, not a confirmed fact.

Image source, Getty Images