EN PT-BR
← Voltar ao feed
critical retail food_processing energy water

France attributes sabotage of refrigeration controllers at about 700 retail sites to IRGC unit Shahid Kaveh

1 fonte(s) · 1 atualização(ões) · publicado 10/11/2026 06:08 · coletado há 1 hora

The French government has attributed an October 2026 sabotage campaign against refrigeration controllers at about 700 retail sites to Shahid Kaveh, a cyber unit of Iran's Islamic Revolutionary Guard Corps (IRGC) (thehackernews.com). On the night of October 11, attackers took remote control of Danfoss and Dixell controllers through their web interfaces, set abnormal defrost cycles at high temperatures, and disabled temperature safety alerts, causing food losses and fires. The Paris prosecutor's office opened a judicial investigation against the unit's head and two deputies and requested international arrest warrants, while the Foreign Ministry plans to summon Iran's ambassador and seek new EU sanctions. The same infrastructure was used for reconnaissance of Schneider Electric equipment at small hydroelectric sites, where the effects were moderate. The main limit on exposure is that the controllers were reachable from the internet, and CERT-FR says the campaigns were probably still underway.

Detalhes técnicos

  • The attackers changed defrost settings to high temperatures and started defrost cycles with no time limit; the temperature probes' safety alerts, which should go off above a certain temperature, were switched off.
  • CERT-FR lists four product families affected by numerous compromises: Danfoss AK-SM and AK-SC series, Copeland xweb, and Dixell xweb.
  • Victims include large retailers such as Casino, Leclerc, Coopérative U, Metro, Carrefour and Intermarché, plus small butcher shops, a slaughterhouse and cooperative food plants.
  • Attribution rests on the reuse of the same infrastructure for reconnaissance of Schneider Electric equipment, reconnaissance techniques Shahid Kaveh has used since at least April, the FOFA scanning tool, Persian text in the attack infrastructure, and IP addresses leading to devices in Iran. The propaganda outlet CyberbanNews reported on the attack on October 13.
  • Shahid Kaveh has claimed earlier attacks on industrial equipment through the CyberAveng3rs persona, including a November 2023 campaign against Unitronics and a March–April sabotage campaign against Israeli and U.S. interests that hit industrial control equipment.
  • The article gives two figures for fires (at least 15 cases in one place, about 20 fires in another) and estimates food losses at several tens of millions of euros.

Remediação

According to the CERT-FR alert, as relayed by the article, last updated October 16:

  • Remove internet exposure from these units and from any unit reachable at a public IP address.
  • Check insurance contract terms before cutting off the data feed to the refrigeration contractor.
  • Review the full configuration, especially the defrost ranges.
  • Restore access only through a secure VPN or a protected network; filtering contractor IP addresses at a firewall is only an emergency measure.
  • Follow the maker's practices; for Danfoss devices, update firmware, set the security level to Strict and change default passwords.
  • For compromised controllers, restart Danfoss equipment or restore factory settings, then reconfigure the device before putting it back into service.
  • End-of-life devices with no security fixes remain at very high risk if exposed to the internet, and a factory reset alone will not stop recompromise.

Linha do tempo

  1. thehackernews.com ↗ · pub. 10/11/2026 06:08 · coletado 10/11 07:00 primeiro registro

    France attributes sabotage of refrigeration controllers at about 700 retail sites to IRGC unit Shahid Kaveh

    ler a análise desta fonte

    The French government has attributed an October 2026 sabotage campaign against refrigeration controllers at about 700 retail sites to Shahid Kaveh, a cyber unit of Iran's Islamic Revolutionary Guard Corps (IRGC) (thehackernews.com). On the night of October 11, attackers took remote control of Danfoss and Dixell controllers through their web interfaces, set abnormal defrost cycles at high temperatures, and disabled temperature safety alerts, causing food losses and fires. The Paris prosecutor's office opened a judicial investigation against the unit's head and two deputies and requested international arrest warrants, while the Foreign Ministry plans to summon Iran's ambassador and seek new EU sanctions. The same infrastructure was used for reconnaissance of Schneider Electric equipment at small hydroelectric sites, where the effects were moderate. The main limit on exposure is that the controllers were reachable from the internet, and CERT-FR says the campaigns were probably still underway.

    Technical Details

    • The attackers changed defrost settings to high temperatures and started defrost cycles with no time limit; the temperature probes' safety alerts, which should go off above a certain temperature, were switched off.
    • CERT-FR lists four product families affected by numerous compromises: Danfoss AK-SM and AK-SC series, Copeland xweb, and Dixell xweb.
    • Victims include large retailers such as Casino, Leclerc, Coopérative U, Metro, Carrefour and Intermarché, plus small butcher shops, a slaughterhouse and cooperative food plants.
    • Attribution rests on the reuse of the same infrastructure for reconnaissance of Schneider Electric equipment, reconnaissance techniques Shahid Kaveh has used since at least April, the FOFA scanning tool, Persian text in the attack infrastructure, and IP addresses leading to devices in Iran. The propaganda outlet CyberbanNews reported on the attack on October 13.
    • Shahid Kaveh has claimed earlier attacks on industrial equipment through the CyberAveng3rs persona, including a November 2023 campaign against Unitronics and a March–April sabotage campaign against Israeli and U.S. interests that hit industrial control equipment.
    • The article gives two figures for fires (at least 15 cases in one place, about 20 fires in another) and estimates food losses at several tens of millions of euros.

    Remediation

    According to the CERT-FR alert, as relayed by the article, last updated October 16:

    • Remove internet exposure from these units and from any unit reachable at a public IP address.
    • Check insurance contract terms before cutting off the data feed to the refrigeration contractor.
    • Review the full configuration, especially the defrost ranges.
    • Restore access only through a secure VPN or a protected network; filtering contractor IP addresses at a firewall is only an emergency measure.
    • Follow the maker's practices; for Danfoss devices, update firmware, set the security level to Strict and change default passwords.
    • For compromised controllers, restart Danfoss equipment or restore factory settings, then reconfigure the device before putting it back into service.
    • End-of-life devices with no security fixes remain at very high risk if exposed to the internet, and a factory reset alone will not stop recompromise.