Lupovis says it detected probes against Danfoss refrigeration controllers days before the attacks

Cybersecurity firm Lupovis says it detected, between October 20 and 30, a reconnaissance period targeting the AK-SM refrigeration managers made by Danfoss, days before the attacks that on November 2 and 3 disrupted refrigeration at supermarkets in nine European countries and at several blood banks in France, according to Euronews.

According to Lupovis, its decoy systems (honeypots) recorded during that period more than 276 attempts from 91 different actors matching specific components of the Danfoss controllers; activity peaked on October 26 and stopped at the end of the month. Its chief executive, Xavier Bellekens, told Euronews Next that the attackers were trying default passwords and a couple of vulnerabilities, and that only its sensors in Europe recorded that activity.

Lupovis says the servers used were "bulletproof hosting", resistant to takedown requests, and that some of those providers had been used in the past by Russian groups. The company says the profile fits a state, but acknowledges it cannot say with certainty that Russia is behind it. No official body has attributed the attacks; according to Euronews, Belgium, Luxembourg, Italy, Portugal and Estonia describe them as a cyberattack, Sweden and Ireland speak of a cyber incident, and ENISA has not explicitly described them as a cyberattack.

Developing story: the reconnaissance data come from Lupovis itself and are so far reported by a single outlet; it has not been possible to consult a report published by the company or confirmation from a public body.