In 2026, attackers hit internet-facing supermarket refrigeration supervisors across Europe. The method was embarrassingly simple: default passwords, unpatched firmware, then forced defrost cycles that could spoil food at scale. The targets were Danfoss AK-SM 800A system managers and Copeland/Dixell XWEB 500 supervisors — industrial control systems that were never designed to face the open internet but ended up there anyway. coldframe is the response from the defender side: a low-interaction honeypot that impersonates those exact controllers. It is one Python file, zero external dependencies, MIT-licensed, and designed to record who connects, what credentials they try, and which known exploits they deploy. It gives attackers nothing real — a fake dashboard with fake refrigerated cases and defrost buttons that log every action. The engineering detail here is the interesting part. The Danfoss persona replicates the exact nginx server header order, the StoreView page title, TLS 1.2 with a self-signed certificate matching real CN=DanfossSM800A issuance patterns, and the documented weak logins (Supervisor / 12345). It recognizes and tags six specific CVEs including the CVE-2025-41450 'code of the day' bypass and CVE-2023-25914 path traversal. The Dixell persona matches XWEB EVO header behavior, the /cgi-bin/login.lua flow, factory defaults (Admin / Admin), and the CVE-2026-25085 authmode bypass. Both generate unique TLS keys per build so no two deployments share a fingerprint. Deployment is designed for minimal overhead: a $4 DigitalOcean droplet running Ubuntu 24.04 with cloud-init, or a rootless Podman container with read-only filesystem, dropped capabilities, 128MB memory cap, and no outbound connectivity. The container runs as a non-root user in its own namespace. Optional Modbus TCP support catches generic industrial scanners, though it's off by default since real AK-SM 800A units only use Modbus internally. The limitations are stated honestly. This is shallow interaction — attackers see a small dashboard and a handful of XML commands, not the full StoreView application. The code is public, so sophisticated attackers can fingerprint it. Some static paths and XML response shapes are plausible guesses, not confirmed from real hardware. Cloud IPs are themselves a tell. The project recommends changing persona strings and certificate subjects for any serious deployment. What makes this worth attention is the broader pattern it represents. Industrial control systems — refrigeration, HVAC, building management — were designed for closed networks and are now exposed at scale. The vulnerability disclosures coldframe tracks span 2021 to 2026, and the attack surface is growing. Default credentials remain the primary entry vector. The tool contributes threat intelligence data that helps the community understand attacker tooling and targeting patterns against operational technology. The existing related work (eppser/danfoss-ak-sm-decoy) offers SNMP and richer simulation; coldframe trades interaction depth for fingerprint accuracy and dual-vendor coverage. Both are open-source. The security research sources are thorough: Synacktiv, Claroty Team82, CISA advisories, Exploit-DB, and Shodan records of real exposed units.
