Iran-linked IRGC cyber units behind destabilizing attacks on French industrial refrigeration controllers
The Centre de Coordination des Crises Cyber (C4), an inter-ministerial body grouping ANSSI, COMCYBER, DGA, DGSE and DGSI, attributes a series of destabilization attacks against French interests to the Shahid Shoostari and Shahid Kaveh cyber-offensive units. These units operate within the CGRI-CEC, the electronic and cyber centre of Iran's Islamic Revolutionary Guard Corps. The most recent case, on 11 and 12 October 2026, targeted French industrial refrigeration controllers, which CERT-FR judges unprecedented in scale and aggressiveness. The report places it in a longer pattern observed since at least 2020, including attacks against Charlie Hebdo in 2023 and a French video display advertising company in 2024 linked to the Paris 2024 Olympic and Paralympic Games. The article names no CVE, malware, IOC, initial access vector or vendor, so defenders have no direct technical indicator to act on. Criticity is high because a state-linked actor is targeting industrial control equipment, but the article describes no confirmed compromise mechanism or public exploit.
Linha do tempo
-
Iran-linked IRGC cyber units behind destabilizing attacks on French industrial refrigeration controllers
ler a análise desta fonte ocultar
The Centre de Coordination des Crises Cyber (C4), an inter-ministerial body grouping ANSSI, COMCYBER, DGA, DGSE and DGSI, attributes a series of destabilization attacks against French interests to the Shahid Shoostari and Shahid Kaveh cyber-offensive units. These units operate within the CGRI-CEC, the electronic and cyber centre of Iran's Islamic Revolutionary Guard Corps. The most recent case, on 11 and 12 October 2026, targeted French industrial refrigeration controllers, which CERT-FR judges unprecedented in scale and aggressiveness. The report places it in a longer pattern observed since at least 2020, including attacks against Charlie Hebdo in 2023 and a French video display advertising company in 2024 linked to the Paris 2024 Olympic and Paralympic Games. The article names no CVE, malware, IOC, initial access vector or vendor, so defenders have no direct technical indicator to act on. Criticity is high because a state-linked actor is targeting industrial control equipment, but the article describes no confirmed compromise mechanism or public exploit.