Coldframe: A lightweight honeypot for supermarket refrigeration controllers

In late 2026, a wave of attacks targeted internet-facing refrigeration supervisors across Europe, exploiting default credentials and unpatched firmware to force defrost cycles. In response, the open-source project coldframe was released as a specialized honeypot designed to mimic these vulnerable industrial devices. It allows security teams to observe attacker behavior without risking actual infrastructure.

What happened

Attackers identified thousands of exposed refrigeration controllers, specifically the Danfoss AK-SM 800A and Copeland/Dixell XWEB 500 series. By leveraging known vulnerabilities and weak factory passwords, they gained access to these operational technology (OT) systems. Once inside, they manipulated environmental controls, triggering unnecessary defrost cycles that could spoil inventory and disrupt supply chains.

coldframe addresses this threat by providing a decoy that looks and behaves like these specific controllers. It is built as a single Python file with no external dependencies, making it easy to deploy and audit. The tool records every connection attempt, password guess, and exploit payload, sending nothing real back to the attacker. This approach turns a vulnerability into an intelligence-gathering opportunity.

The project supports two distinct personas. The danfoss persona emulates the AK-SM 800A system manager, serving a fake StoreView login and dashboard. The dixell persona mimics the XWEB EVO supervisor, replicating its specific CGI paths and login flows. Both personas are designed to pass the initial fingerprinting checks used by automated scanners and human attackers alike.

How it works

coldframe achieves realism by carefully copying the network fingerprints of real devices. For the Danfoss persona, it replicates the nginx server header order, restricts TLS to version 1.2, and uses a self-signed certificate with the exact common name CN=DanfossSM800A. It even serves a byte-for-byte copy of the Angular loader page found in public firmware packages if configured to do so. This ensures that scanners matching device hashes see what they expect.

The honeypot interacts with attackers by accepting known weak credentials, such as Supervisor / 12345, or bypassing authentication using documented exploits like CVE-2025-41450. When an attacker logs in, they are presented with a static dashboard featuring fake refrigerated cases and defrost buttons. Any action taken, such as clicking a defrost button, is logged as a control event but has no effect on any physical hardware. The Dixell persona similarly accepts the factory default Admin / Admin login and enforces account lockout after five failed attempts, just like the real device.

Optionally, coldframe can run a Modbus TCP service to attract generic industrial scanners. This service provides fake temperature readings and setpoints. However, since real AK-SM 800A units typically use Modbus only for internal communication, this feature is disabled by default to maintain a realistic profile. All interactions are recorded in a JSON line format, capturing source IPs, payloads, and specific exploit attempts.

Key details

• Zero dependencies: The core honeypot is a single Python file using only the standard library, simplifying deployment and reducing attack surface.
• Two personas: Supports emulation of Danfoss AK-SM 800A and Copeland/Dixell XWEB EVO controllers with distinct web interfaces and API behaviors.
• Exploit detection: Recognizes and logs attempts for seven specific CVEs, including path traversal, command injection, and authentication bypasses like CVE-2025-41450 and CVE-2026-25085.
• Realistic fingerprinting: Replicates server headers, TLS configurations, certificate subjects, and optional firmware assets to evade simple scanner filters.
• Secure containment: Runs in a read-only container with dropped capabilities and user namespace isolation, ensuring that even if the honeypot is compromised, the host remains safe.
• Modbus support: Optional Modbus TCP listener with fake register data to capture broader industrial scanning activity.

Why it matters

For security engineers and OT specialists, coldframe provides visibility into active threats against critical infrastructure. Refrigeration controllers are often overlooked in security audits because they are seen as simple appliances, yet they run complex web servers and operating systems. By deploying these honeypots, organizations can detect when attackers are probing their network perimeter for IoT devices before they move laterally to more sensitive systems.

The tool also helps validate defensive measures. By seeing which exploits are being attempted in the wild, teams can prioritize patching for specific vulnerabilities like the "code of the day" bypass in Danfoss units. The detailed logs allow analysts to understand attacker tactics, techniques, and procedures (TTPs) specific to the retail and food supply sector. This intelligence is crucial for building better detection rules and hardening real devices against similar attacks.

Furthermore, the low-resource footprint of coldframe makes it accessible for small businesses and large enterprises alike. It can be deployed on a minimal cloud instance or a local Raspberry Pi, providing an affordable way to monitor for IoT-focused threats. The emphasis on safety, with strict input sanitization and resource limits, ensures that the monitoring tool itself does not become a liability.

What you can do

• Deploy a coldframe instance on a cloud provider using the provided cloud-init script to quickly start monitoring for attacks on port 80 and 443.
• Configure the PERSONA environment variable to match the specific types of controllers present in your own environment for more relevant threat intelligence.
• Regularly review the events.jsonl log file or use the included summary.py script to identify new attack patterns and source IPs.
• Harden your real OT devices by changing default passwords, disabling unused services like Modbus if not needed, and applying firmware updates for known CVEs.
• Use the captured exploit payloads to update your web application firewall (WAF) rules and intrusion detection system (IDS) signatures.
• Contribute to the project by reporting false positives or suggesting improvements to the persona fidelity, helping to keep the honeypot effective against evolving scanners.