Coldframe honeypot poses as a supermarket fridge controller to log the next attack
Built after the October and November attacks on European stores, the MIT-licensed decoy logs logins and exploit probes against Danfoss and Dixell controllers.
By Ryan Merket · Published
Primary source: github.com
Why it matters
Refrigeration controllers in supermarkets turned out to be reachable, remotely controllable attack surface, and attackers used that access twice in a month to spoil food across Europe. Coldframe gives defenders a cheap, inspectable way to see who is probing Danfoss and Dixell controllers and which known exploits they reach for.
An open-source developer publishing as hedgerow-dev has released Coldframe, a low-interaction honeypot that poses as a supermarket refrigeration controller and records what attackers try after they find it. The repository was created on November 5th, 2026, two days after refrigeration attacks disrupted stores across Europe for the second time in a month.…
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.