EN PT-BR
← Voltar ao feed
critical retail food_and_agriculture

France attributes sabotage of supermarket refrigeration controllers to IRGC-linked Shahid Kaveh unit

1 fonte(s) · 1 atualização(ões) · publicado 09/11/2026 16:12 · coletado há 1 hora

On 9 November 2026 the French government, through the Paris prosecutor's office and the Cyber Crisis Coordination Centre (C4), blamed the Islamic Revolutionary Guard Corps (IRGC) for sabotaging refrigeration controllers at about 700 French grocery sites on 11 and 12 October (therecord.media). The Shahid Kaveh cyber unit, tied to the IRGC Electronic and Cyber Center, was named as the operator, and the report's annex names its commanders (therecord.media). Foreign Minister Jean-Noël Barrot summoned Iran's ambassador and promised EU sanctions, while Paris prosecutors opened a judicial inquiry into the unit's head and two deputies and requested international arrest warrants (therecord.media). Iran routinely denies malicious cyber operations and had not responded to the allegations by the time of reporting (therecord.media). The attacks reportedly forced defrost cycles, destroyed perishable stock and started at least 15 fires (therecord.media). This is an official attribution rather than an independently verified finding, and no vendor advisory, CVE or patch is tied to the campaign in the sources reviewed, so defenders should rely on the generic CISA and FBI guidance.

Detalhes técnicos

  • Five US federal bodies (CISA, FBI, HHS, USDA and DOT) issued a fact sheet on 5 November 2026 describing hostile activity against electronic temperature controllers and commercial refrigeration controllers in grocery stores and cold storage sites (gbhackers.com).
  • The fact sheet cites authentication bypass and arbitrary code injection as possible exploitation paths, but it names no specific vulnerability and no affected manufacturer (gbhackers.com).
  • Successful intrusion would let an attacker change settings remotely and push units into heating or defrost cycles, with consequences such as inventory loss, fire hazards and operators losing sight of real temperatures (gbhackers.com).
  • French investigators tied the campaign to Shahid Kaveh through Farsi text artefacts, tooling and infrastructure used to scout other industrial equipment (therecord.media).
  • ANSSI also reported that the same actors targeted Schneider Electric equipment at several small hydroelectric facilities, with moderate disruption (therecord.media).
  • US agencies had earlier identified Shahid Kaveh as another name for CyberAv3ngers, a group linked to disruptive attacks on operational technology across US critical infrastructure (therecord.media).
  • ANSSI attributes earlier French incidents to Shahid Shoostari, also known as Emennet Pasargad, including a defacement of the Charlie Hebdo website and an attempt to hijack Paris Olympics display screens in 2024 (therecord.media).

Remediação

  • Remove refrigeration and temperature controllers from direct internet exposure; where remote access is required, route it through a protected, updated firewall or edge device (gbhackers.com).
  • Place operational technology on dedicated network segments separated from business systems (gbhackers.com).
  • Replace default passwords, enforce strong credentials, adopt phishing-resistant multifactor authentication where feasible, update firmware and replace unsupported devices (gbhackers.com).
  • Restrict who can change settings with device and IP allowlisting (gbhackers.com).
  • Keep tested offline backups, review logs and set safe operating limits with alerts on deviations; report suspicious activity to CISA or the FBI (gbhackers.com).

Relatos divergentes

  • Scope of the second wave: the article says at least nine other European countries reported freezer attacks on 2 November, while therecord.media reports at least 11 European countries (therecord.media). The Record's count is the more specific figure, but neither source gives a per-country list.
  • Fires: the article says fires broke out in several stores, while therecord.media reports at least 15 fires attributed to the French government's report (therecord.media).
  • Earlier incident: the article describes a 2023 breach of an online store attributed to Emennet Pasargad, while therecord.media describes Emennet Pasargad's activity against Charlie Hebdo as a website defacement and gives no 2023 store breach (therecord.media).

Linha do tempo

  1. securityaffairs.com ↗ · pub. 09/11/2026 16:12 · coletado 09/11 18:00 primeiro registro

    France attributes sabotage of supermarket refrigeration controllers to IRGC-linked Shahid Kaveh unit

    ler a análise desta fonte

    On 9 November 2026 the French government, through the Paris prosecutor's office and the Cyber Crisis Coordination Centre (C4), blamed the Islamic Revolutionary Guard Corps (IRGC) for sabotaging refrigeration controllers at about 700 French grocery sites on 11 and 12 October (therecord.media). The Shahid Kaveh cyber unit, tied to the IRGC Electronic and Cyber Center, was named as the operator, and the report's annex names its commanders (therecord.media). Foreign Minister Jean-Noël Barrot summoned Iran's ambassador and promised EU sanctions, while Paris prosecutors opened a judicial inquiry into the unit's head and two deputies and requested international arrest warrants (therecord.media). Iran routinely denies malicious cyber operations and had not responded to the allegations by the time of reporting (therecord.media). The attacks reportedly forced defrost cycles, destroyed perishable stock and started at least 15 fires (therecord.media). This is an official attribution rather than an independently verified finding, and no vendor advisory, CVE or patch is tied to the campaign in the sources reviewed, so defenders should rely on the generic CISA and FBI guidance.

    Technical Details

    • Five US federal bodies (CISA, FBI, HHS, USDA and DOT) issued a fact sheet on 5 November 2026 describing hostile activity against electronic temperature controllers and commercial refrigeration controllers in grocery stores and cold storage sites (gbhackers.com).
    • The fact sheet cites authentication bypass and arbitrary code injection as possible exploitation paths, but it names no specific vulnerability and no affected manufacturer (gbhackers.com).
    • Successful intrusion would let an attacker change settings remotely and push units into heating or defrost cycles, with consequences such as inventory loss, fire hazards and operators losing sight of real temperatures (gbhackers.com).
    • French investigators tied the campaign to Shahid Kaveh through Farsi text artefacts, tooling and infrastructure used to scout other industrial equipment (therecord.media).
    • ANSSI also reported that the same actors targeted Schneider Electric equipment at several small hydroelectric facilities, with moderate disruption (therecord.media).
    • US agencies had earlier identified Shahid Kaveh as another name for CyberAv3ngers, a group linked to disruptive attacks on operational technology across US critical infrastructure (therecord.media).
    • ANSSI attributes earlier French incidents to Shahid Shoostari, also known as Emennet Pasargad, including a defacement of the Charlie Hebdo website and an attempt to hijack Paris Olympics display screens in 2024 (therecord.media).

    Remediation

    • Remove refrigeration and temperature controllers from direct internet exposure; where remote access is required, route it through a protected, updated firewall or edge device (gbhackers.com).
    • Place operational technology on dedicated network segments separated from business systems (gbhackers.com).
    • Replace default passwords, enforce strong credentials, adopt phishing-resistant multifactor authentication where feasible, update firmware and replace unsupported devices (gbhackers.com).
    • Restrict who can change settings with device and IP allowlisting (gbhackers.com).
    • Keep tested offline backups, review logs and set safe operating limits with alerts on deviations; report suspicious activity to CISA or the FBI (gbhackers.com).

    Conflicting Reports

    • Scope of the second wave: the article says at least nine other European countries reported freezer attacks on 2 November, while therecord.media reports at least 11 European countries (therecord.media). The Record's count is the more specific figure, but neither source gives a per-country list.
    • Fires: the article says fires broke out in several stores, while therecord.media reports at least 15 fires attributed to the French government's report (therecord.media).
    • Earlier incident: the article describes a 2023 breach of an online store attributed to Emennet Pasargad, while therecord.media describes Emennet Pasargad's activity against Charlie Hebdo as a website defacement and gives no 2023 store breach (therecord.media).