France attributes October supermarket refrigeration sabotage to Iran's IRGC-linked Shahid Kaveh unit
On Monday 9 November 2026, France formally attributed the October 11–12 remote sabotage of supermarket refrigeration controllers to Shahid Kaveh, an offensive cyber unit of Iran's Islamic Revolutionary Guard Corps (IRGC), and opened a judicial investigation (aljazeera.com; axios.com). The campaign hit roughly 700 of France's 10,000 supermarkets, and the attackers pushed cabinet temperatures to about 50 °C for around six hours, forcing stores to discard fresh and frozen goods. Intermarché reported losses in the tens of millions of euros in a single day. French prosecutors are seeking international arrest warrants for the group's leader and his two deputies, and Paris plans European sanctions and has summoned Iran's ambassador. The article also links a second IRGC-affiliated group, Shahid Shoostari, to earlier attacks on Charlie Hebdo (2023) and the Paris 2024 Olympics, and reports a thwarted attack on French blood banks the same month. The rating is critical because the sabotage is confirmed and large-scale, although the article does not state the initial access vector.
Detalhes técnicos
- Attackers gained remote control of refrigeration controllers in hundreds of stores and independent shops across France in the early hours of 12 October, and the article gives no initial access vector.
- Prosecutors named Danfoss and Dixell refrigeration controllers as the targeted products (thenationalnews.com).
- France's Cyber Crisis Coordination Center (C4), which groups ANSSI, military cyber command and intelligence services, issued a five-page attribution report (sofx.com). It relied on Farsi-language artifacts, intrusion tooling, infrastructure matching earlier hacks by the unit, and IP addresses in Iran (sofx.com).
- The propaganda outlet CyberbanNews, linked to Shahid Kaveh, publicized the refrigeration attacks on 13 October (bleepingcomputer.com).
- CERT-FR says Shahid Kaveh works through hacktivist personas including CyberAveng3rs, Soldiers of Solomon, Mr. Soul and Cyber Isnaad Front (bleepingcomputer.com).
- The same hackers reportedly targeted controllers at French hydroelectric sites, and that attack sparked at least 15 fires (sofx.com).
- Its chief, Hamid Lashgarian, is under US sanctions with a $10 million reward offered for information (thenationalnews.com).
Remediação
- The article names no vendor advisory or fix. This research did not open a Danfoss or Dixell advisory, so the guidance below is general hardening, not a vendor fix.
- Remove direct internet exposure of refrigeration controllers and their management interfaces, and place them behind segmented OT networks with VPN or jump-host access.
- Replace default and weak credentials on controllers and remote management accounts, and enforce unique passwords with multi-factor authentication where the device supports it.
- Alarm on abnormal cabinet temperature and on unexpected setpoint changes, and keep manual fallback procedures to limit spoilage.
- Inventory exposed controllers and check the IP addresses and Farsi-linked activity described in the attribution against your logs.
Relatos divergentes
- The article dates the attack to 12 October. Axios and Al Jazeera place it on 11–12 October (axios.com; aljazeera.com).
Linha do tempo
-
France attributes October supermarket refrigeration sabotage to Iran's IRGC-linked Shahid Kaveh unit
ler a análise desta fonte ocultar
On Monday 9 November 2026, France formally attributed the October 11–12 remote sabotage of supermarket refrigeration controllers to Shahid Kaveh, an offensive cyber unit of Iran's Islamic Revolutionary Guard Corps (IRGC), and opened a judicial investigation (aljazeera.com; axios.com). The campaign hit roughly 700 of France's 10,000 supermarkets, and the attackers pushed cabinet temperatures to about 50 °C for around six hours, forcing stores to discard fresh and frozen goods. Intermarché reported losses in the tens of millions of euros in a single day. French prosecutors are seeking international arrest warrants for the group's leader and his two deputies, and Paris plans European sanctions and has summoned Iran's ambassador. The article also links a second IRGC-affiliated group, Shahid Shoostari, to earlier attacks on Charlie Hebdo (2023) and the Paris 2024 Olympics, and reports a thwarted attack on French blood banks the same month. The rating is critical because the sabotage is confirmed and large-scale, although the article does not state the initial access vector.
Technical Details
- Attackers gained remote control of refrigeration controllers in hundreds of stores and independent shops across France in the early hours of 12 October, and the article gives no initial access vector.
- Prosecutors named Danfoss and Dixell refrigeration controllers as the targeted products (thenationalnews.com).
- France's Cyber Crisis Coordination Center (C4), which groups ANSSI, military cyber command and intelligence services, issued a five-page attribution report (sofx.com). It relied on Farsi-language artifacts, intrusion tooling, infrastructure matching earlier hacks by the unit, and IP addresses in Iran (sofx.com).
- The propaganda outlet CyberbanNews, linked to Shahid Kaveh, publicized the refrigeration attacks on 13 October (bleepingcomputer.com).
- CERT-FR says Shahid Kaveh works through hacktivist personas including CyberAveng3rs, Soldiers of Solomon, Mr. Soul and Cyber Isnaad Front (bleepingcomputer.com).
- The same hackers reportedly targeted controllers at French hydroelectric sites, and that attack sparked at least 15 fires (sofx.com).
- Its chief, Hamid Lashgarian, is under US sanctions with a $10 million reward offered for information (thenationalnews.com).
Remediation
- The article names no vendor advisory or fix. This research did not open a Danfoss or Dixell advisory, so the guidance below is general hardening, not a vendor fix.
- Remove direct internet exposure of refrigeration controllers and their management interfaces, and place them behind segmented OT networks with VPN or jump-host access.
- Replace default and weak credentials on controllers and remote management accounts, and enforce unique passwords with multi-factor authentication where the device supports it.
- Alarm on abnormal cabinet temperature and on unexpected setpoint changes, and keep manual fallback procedures to limit spoilage.
- Inventory exposed controllers and check the IP addresses and Farsi-linked activity described in the attribution against your logs.
Conflicting Reports
- The article dates the attack to 12 October. Axios and Al Jazeera place it on 11–12 October (axios.com; aljazeera.com).