Cyberattacks on fridges: NoName and Z-Peintest claim responsibility – but the video does not settle the matter

NoName057(16) and Z-Peintest are, in the investigators’ view, not in the same league. NoName has built much of its notoriety through DDoS campaigns: high-profile, visible operations, but not necessarily sophisticated ones. Z-Peintest, on the other hand, is credited with far greater technical capabilities. According to the investigators’ reconstruction, both operate within the sphere of influence of the GRU, the Russian military intelligence service.

The difference matters. Penetrating distributed cooling systems across several countries requires different capabilities to those needed for a traditional DDoS attack. And this is also why investigators are trying to distinguish between what the two groups claim to have done and what can be proven they actually did.

In Italia, the matter is being handled by the National Cybersecurity Agency, headed by Andrea Quacivi. Also involved are the AISI, headed by Bruno Valensise, and the AISE, led by Giovanni Caravelli, coordinated by the Department of Security Intelligence, headed by Prefect Vittorio Rizzi. Political coordination is the responsibility of the Delegate for the Security of the Republic, Alfredo Mantovano, who yesterday convened a meeting of the relevant agencies to take stock of the situation.

This is where the story takes a different turn. Because when NoName carries out an operation, it claims responsibility. And it usually does so quickly: it strikes, publishes, amplifies. The attack becomes propaganda.
Not this time. The first attack in France took place on 12 October. The claim of responsibility for the fridges has only just emerged. A delay of over three weeks which proves nothing, but which investigators regard as an anomaly that needs explaining. Why wait so long? And what exactly is NoName claiming responsibility for: the entire European sequence or just part of it?

Then there is the issue of the channel. On NoName’s Telegram channel, at least in the publicly visible section, there is no message explicitly attributing the attacks on the fridges to the group.

There is, however, one detail that is worth revisiting. On 3 November, NoName announced a massive DDoS attack against Danfoss’s servers and referred to the ‘cyberattacks on critical infrastructure’ that ‘are already raging in at least 20 countries (most of which are NATO members). Among the targets: water supply systems, power stations, industrial plants, wineries and food warehouses’.

A reference very close to the scope of the operation. But no explicit claim regarding the fridges. The intrusion into the supermarkets’ refrigeration systems, in fact, is believed to have been carried out using access keys stolen from Danfoss. On 3 November, however, NoName struck the same company with a DDoS attack: a brute-force, high-profile and direct assault, entirely in keeping with its usual modus operandi. And they claimed responsibility for that immediately.
The point is precisely this: those who already possess the keys to enter the systems do not need to kick the door down to gain access.

There is also another issue. The latest claim on their Telegram channel – made today, 4 November – concerns a DDoS attack on airports in Germany.

It is within this space – between what appears to be the case and what can be proven – that the organisations are now operating.
The first hypothesis is the most straightforward: NoName and Z-Peintest did in fact carry out the operation and, for reasons yet to be clarified, have decided to claim responsibility for it only now.
The second is that the two collectives came in later and claimed credit for an action carried out by others. An opportunistic claim, useful for lending credence to operational capabilities greater than those actually possessed. In this scenario, the video’s content would not necessarily be false: it is the claim of responsibility attached to the operation that would be false.
However, investigative assessments also suggest a third hypothesis. The most delicate one. That the video was produced neither by the perpetrators of the attack nor by those seeking to claim credit for it, but by an entity unrelated to the operation with a specific aim: to provoke a reaction. To cast a bait into the cyber landscape and observe who responds, who corrects details, who claims responsibility, and who ends up revealing something that had not previously come to light.

In other words: using a fake trace to force the real perpetrator to leave a genuine one.

Because there is a fourth level of analysis: the attacks may not all have been carried out by the same perpetrator. The French incidents, in particular, may stem from a different source – potentially even a state actor – whilst other phases of the campaign may be attributable to different actors.
What has so far appeared to be a single European offensive could therefore be, at least in part, an overlap of different operations, all targeting the same technological target.

It is merely an assessment. Just as the other scenarios are, at present. And that is precisely the point: the more evidence comes to light, the less straightforward the attribution becomes.