A new open-source security tool called Coldframe has appeared on GitHub, designed to lure attackers by pretending to be a supermarket refrigeration controller. Created by developer hedgerow-dev, the project is a low-interaction honeypot that emulates two widely used commercial refrigeration systems: the Danfoss AK-SM 800A and the Dixell XWEB 500.
Honeypots like Coldframe are decoys that attract hackers away from real systems while logging their activity. By posing as mundane building equipment, Coldframe targets a often-overlooked attack surface: the internet-connected controllers that keep supermarket freezers and fridges running. The project was shared as a "Show HN" post on GitHub, signaling it is aimed at security researchers and industrial control system (ICS) defenders.
What Coldframe does
Coldframe is a low-interaction honeypot, meaning it simulates enough of a service to engage attackers but does not run a full, vulnerable operating system. It mimics the network behavior and responses of the Danfoss AK-SM 800A and Dixell XWEB 500, two popular refrigeration controllers found in supermarkets and cold storage facilities worldwide.
The tool is hosted on GitHub under the repository hedgerow-dev/coldframe. It is written to be lightweight and easy to deploy, allowing security teams to set up a fake controller on their network and watch for intrusion attempts. The project is open source and includes a Containerfile for containerized deployment, making it simple to run in Docker or similar environments.
Why refrigeration controllers are a target
Refrigeration controllers are part of the broader industrial control system (ICS) landscape. Many are connected to the internet for remote monitoring and management, often with weak or default credentials. Attackers who gain access can disrupt cooling, spoof temperature readings, or pivot into corporate networks.
Honeypots like Coldframe help defenders understand what attackers are looking for. By logging attempts to access the fake controller, security teams can detect scanning activity, identify common attack vectors, and improve protection for real equipment. The project is particularly relevant for supermarkets, food logistics companies, and any facility that relies on temperature-controlled storage.
