Coldframe honeypot poses as supermarket refrigeration controllers targeted in 2026 attacks

Coldframe, a new open-source honeypot that impersonates supermarket refrigeration controllers, reached the Hacker News front page on 7 November 2026 through a Show HN post. The project, hosted on GitHub under hedgerow-dev, is presented as a direct response to this year's European intrusions into supermarket cooling systems, in which attackers used default credentials and outdated firmware to take over exposed refrigeration supervisors and trigger defrost cycles. Coldframe invites those same attackers in, records what they do, and gives them nothing real in return.

What the honeypot does

According to the project's readme, the entire tool is one Python file with no dependencies beyond the standard library. It offers two personas. The Danfoss persona imitates the AK-SM 800A system manager, serving a StoreView-style login, a simulated dashboard of chilled display cases, and the XML API endpoints the real product exposes, over both HTTP and HTTPS. The Dixell persona imitates a Copeland/Dixell XWEB EVO supervisor, reproducing its login flow and the /cgi-bin/ paths that public exploits target.

Both personas accept the logins real units are known for. On the Danfoss side, weak credentials such as Supervisor/12345 succeed, along with a correctly computed CVE-2025-41450 "code of the day". On the Dixell side, the documented factory pair Admin/Admin works, and five failed logins within five minutes cause a lockout, mirroring genuine device behaviour. Successful intruders receive a session token and a dashboard with defrost controls; every action is written to the log as a control event while no physical process is ever affected.

Mimicking real hardware

Internet scanners fingerprint devices through details like server headers and favicon hashes, and Coldframe copies what they observe on genuine units. The readme says the Danfoss persona reproduces the nginx server header and its ordering, the StoreView page title, TLS 1.2 only, and a one-year self-signed certificate matching the subject and issuer strings of real hardware, with fresh keys generated per build. The Dixell persona omits the Server header entirely and matches the header set, asset paths and page sizes of actual XWEB units.

Two vendor-owned assets are deliberately left out of the repository: the favicon and Danfoss's Angular loader start page. Operators who legitimately hold copies can point configuration variables at those files, and the decoy will then serve the loader byte for byte, preserving its original Last-Modified date and ETag. An optional Modbus TCP service with simulated case temperatures, setpoints and a defrost register ships disabled, because real AK-SM units only speak Modbus to their own case controllers; the readme suggests enabling it to attract generic industrial scanners.

Exploits it recognises

Requests matching known public exploits are tagged with an exploit field in the log. The readme lists CVE-2023-25914 and CVE-2023-25915, path traversal and command injection on the AK-SM 800A; CVE-2025-41452, an nginx header overwrite; CVE-2025-41450, the code-of-the-day login bypass, including whether the attacker derived the correct code; CVE-2021-45420, the XWEB 500 upload and command paths; and CVE-2026-25085, an XWEB Pro login bypass via an unexpected auth_mode.

Deployment and safety

Deployment is designed to be cheap and isolated. A bundled cloud-init file brings the decoy up on an Ubuntu 24.04 server roughly two minutes after boot, and the container runs with a read-only filesystem, all capabilities dropped, its own user namespace, and tight memory and process limits. The readme warns that rootless port forwarding rewrites source addresses, which would make every attacker appear to come from the same internal IP.

Safety measures include refusing to execute attacker commands, touch the filesystem or relay traffic; exploit payloads are logged and discarded. Request bodies, logged fields and connections are capped, with per-source limits so a single attacker cannot crowd out others; idle sockets time out and connections that trickle data are cut after 30 seconds. Logs are JSON lines covering requests, credentials, control actions, XML commands, TLS errors and Modbus traffic, and a summary script condenses them into a report.

Stated limitations

The readme is candid about weaknesses: interaction is shallow, the public code can be fingerprinted by anyone who reads the repository, some response details are plausible guesses rather than confirmed device behaviour, and cloud-hosted decoys may themselves look suspicious to scanners.

Why it matters

The 2026 campaign showed that supermarket refrigeration can be compromised with factory passwords and ageing firmware, and that the consequences are physical: spoiled stock and disrupted stores. Coldframe converts that exposure into intelligence. By logging credentials, exploits and scanning patterns against exactly the devices being targeted, it shows defenders which techniques are circulating and feeds patching priorities and blocklists, all for the cost of a small server. For a sector with little in-house security staff, a honeypot deployable in an afternoon is a pragmatic first sensor.