EN PT-BR
← Voltar ao feed
critical retail food_processing energy healthcare

France attributes October sabotage of refrigeration controllers at about 700 sites to IRGC unit Shahid Kaveh

1 fonte(s) · 1 atualização(ões) · publicado 10/11/2026 06:26 · coletado há 1 hora

French authorities formally attributed the October 11-12 sabotage of remote refrigeration controllers to Shahid Kaveh, a unit the government links to the IRGC (thehackernews.com). The intrusions reached about 700 French retail sites, and the prosecutor's office said they caused food losses and about 20 fires (thehackernews.com). The attribution rests on four indicators gathered by the C4 cyber crisis coordination center, including reconnaissance infrastructure reused against Schneider Electric equipment at small hydroelectric sites, Persian-language traces and IP addresses leading to Iran (thehackernews.com). The Paris prosecutor opened a judicial investigation against the unit's head and two deputies and requested international arrest warrants, while the Foreign Ministry plans to summon Iran's ambassador and seek new EU sanctions (thehackernews.com). The government describes it as the first offensive cyber campaign on French soil carried out purely for sabotage (thehackernews.com; axios.com). The campaign relied on internet-exposed management interfaces and configuration weaknesses rather than a CVE-tracked flaw, and CERT-FR's alert, last updated October 16, warns that attacks were probably still underway (thehackernews.com).

Detalhes técnicos

  • Operators reached Danfoss and Dixell controllers through their web interfaces, then started defrost cycles with no time limit and switched off the temperature probes' safety alerts (thehackernews.com).
  • CERT-FR's alert names four product families: Danfoss AK-SM and AK-SC series, Copeland xweb and Dixell xweb (thehackernews.com).
  • Reconnaissance used the FOFA scanning engine, and the same infrastructure scanned Schneider Electric equipment at energy and water sites; the techniques date to at least April (thehackernews.com).
  • Most victims were large French retailers, including Casino, Leclerc, Cooperative U, Metro, Carrefour and Intermarche, with small butcher shops, a slaughterhouse and food cooperatives also hit (thehackernews.com).
  • Effects on the hydroelectric Schneider Electric equipment were moderate (thehackernews.com).
  • Shahid Kaveh operates mostly through hacktivist personas such as CyberAveng3rs and Cyber Isnaad Front, which publicly claim some of its attacks (thehackernews.com); Axios adds Soldiers of Solomon (axios.com).
  • The unit previously claimed an industrial campaign against Unitronics in November 2023 and a March-April campaign against Israeli and U.S. industrial control equipment, including Israeli refrigeration equipment (thehackernews.com).

Remediação

  • Remove internet exposure from affected controllers and from any unit reachable on a public IP address, and restore access only through a secure VPN or protected network (thehackernews.com).
  • Review the full configuration, especially defrost ranges, and check insurance terms before cutting the data feed to the refrigeration contractor (thehackernews.com).
  • For Danfoss devices, update firmware, set the security level to Strict and confirm default passwords are changed (thehackernews.com).
  • For compromised controllers, restart or factory-reset the device and reconfigure it before returning it to service; a reset alone does not remove the exposure of end-of-life devices, which CERT-FR says will almost certainly be compromised again (thehackernews.com).

Relatos divergentes

  • The article says the Ministry summoned Iran's ambassador; The Hacker News reports the Foreign Ministry plans to do so (thehackernews.com). The later-dated source is the more precise one for the state of the action.
  • The article says the spread reached supermarkets in Belgium, Sweden and Luxembourg and blood transfusion facilities in France; the sources opened do not confirm either claim, and The Hacker News states the government attribution does not mention a separate wave in other European countries (thehackernews.com; axios.com).
  • The article says protective segmentation contained the hydroelectric intrusion before disruption; The Hacker News reports moderate effects on the Schneider Electric equipment (thehackernews.com).
  • The article says about fifteen fires; the prosecutor's office, as reported by The Hacker News, counts about 20 (thehackernews.com).
  • The article says the unit operates under the IRGC Cyber-Electronic Command; the sources opened name only the IRGC as sponsor and do not use that command name (thehackernews.com).

Linha do tempo

  1. securityonline.info ↗ · pub. 10/11/2026 06:26 · coletado 10/11 07:00 primeiro registro

    France attributes October sabotage of refrigeration controllers at about 700 sites to IRGC unit Shahid Kaveh

    ler a análise desta fonte

    French authorities formally attributed the October 11-12 sabotage of remote refrigeration controllers to Shahid Kaveh, a unit the government links to the IRGC (thehackernews.com). The intrusions reached about 700 French retail sites, and the prosecutor's office said they caused food losses and about 20 fires (thehackernews.com). The attribution rests on four indicators gathered by the C4 cyber crisis coordination center, including reconnaissance infrastructure reused against Schneider Electric equipment at small hydroelectric sites, Persian-language traces and IP addresses leading to Iran (thehackernews.com). The Paris prosecutor opened a judicial investigation against the unit's head and two deputies and requested international arrest warrants, while the Foreign Ministry plans to summon Iran's ambassador and seek new EU sanctions (thehackernews.com). The government describes it as the first offensive cyber campaign on French soil carried out purely for sabotage (thehackernews.com; axios.com). The campaign relied on internet-exposed management interfaces and configuration weaknesses rather than a CVE-tracked flaw, and CERT-FR's alert, last updated October 16, warns that attacks were probably still underway (thehackernews.com).

    Technical Details

    • Operators reached Danfoss and Dixell controllers through their web interfaces, then started defrost cycles with no time limit and switched off the temperature probes' safety alerts (thehackernews.com).
    • CERT-FR's alert names four product families: Danfoss AK-SM and AK-SC series, Copeland xweb and Dixell xweb (thehackernews.com).
    • Reconnaissance used the FOFA scanning engine, and the same infrastructure scanned Schneider Electric equipment at energy and water sites; the techniques date to at least April (thehackernews.com).
    • Most victims were large French retailers, including Casino, Leclerc, Cooperative U, Metro, Carrefour and Intermarche, with small butcher shops, a slaughterhouse and food cooperatives also hit (thehackernews.com).
    • Effects on the hydroelectric Schneider Electric equipment were moderate (thehackernews.com).
    • Shahid Kaveh operates mostly through hacktivist personas such as CyberAveng3rs and Cyber Isnaad Front, which publicly claim some of its attacks (thehackernews.com); Axios adds Soldiers of Solomon (axios.com).
    • The unit previously claimed an industrial campaign against Unitronics in November 2023 and a March-April campaign against Israeli and U.S. industrial control equipment, including Israeli refrigeration equipment (thehackernews.com).

    Remediation

    • Remove internet exposure from affected controllers and from any unit reachable on a public IP address, and restore access only through a secure VPN or protected network (thehackernews.com).
    • Review the full configuration, especially defrost ranges, and check insurance terms before cutting the data feed to the refrigeration contractor (thehackernews.com).
    • For Danfoss devices, update firmware, set the security level to Strict and confirm default passwords are changed (thehackernews.com).
    • For compromised controllers, restart or factory-reset the device and reconfigure it before returning it to service; a reset alone does not remove the exposure of end-of-life devices, which CERT-FR says will almost certainly be compromised again (thehackernews.com).

    Conflicting Reports

    • The article says the Ministry summoned Iran's ambassador; The Hacker News reports the Foreign Ministry plans to do so (thehackernews.com). The later-dated source is the more precise one for the state of the action.
    • The article says the spread reached supermarkets in Belgium, Sweden and Luxembourg and blood transfusion facilities in France; the sources opened do not confirm either claim, and The Hacker News states the government attribution does not mention a separate wave in other European countries (thehackernews.com; axios.com).
    • The article says protective segmentation contained the hydroelectric intrusion before disruption; The Hacker News reports moderate effects on the Schneider Electric equipment (thehackernews.com).
    • The article says about fifteen fires; the prosecutor's office, as reported by The Hacker News, counts about 20 (thehackernews.com).
    • The article says the unit operates under the IRGC Cyber-Electronic Command; the sources opened name only the IRGC as sponsor and do not use that command name (thehackernews.com).