France attributes October sabotage of supermarket refrigeration controllers to Iran's Shahid Kaveh unit
France's Cyber Crisis Coordination Centre (C4) attributes the October attacks on refrigeration controllers at more than 700 grocery stores to the IRGC cyber unit Shahid Kaveh, better known as CyberAv3ngers (article, citing the C4 report). The attacks affected Casino, Leclerc, Coopérative U, Metro, Carrefour and Intermarché groups, started at least 15 fires and caused food losses in the tens of millions of euros. Paris prosecutors say the attackers used Farsi and IP addresses linked to devices in Iran, and they are seeking international arrest warrants (pbs.org). The C4 report describes the campaign as the first cyber offensive carried out purely for sabotage on national territory, and no CVE or vendor advisory for the controllers was identified in the sources opened, so the public record is attribution-driven rather than vulnerability-driven.
Detalhes técnicos
- Since at least June 2024, the Shahid Kaveh unit has been able to scan, access and control industrial control equipment from Schneider Electric, Siemens and Rockwell (article).
- The infrastructure used for the October supermarket attacks was also used in the same period to run reconnaissance against Schneider Electric equipment, focused on small and medium energy and water production units (article).
- Temperatures reached 50°C (122°F) for about six hours, forcing stores to discard fresh food (pbs.org).
- Similar attacks on commercial refrigerators were reported in early November in Belgium, Ireland, Luxembourg and Sweden (article).
Remediação
- Owners and operators of refrigeration and other industrial controllers should confirm that no controller is reachable from the internet, and should restrict and monitor remote access paths, which the article describes as the means of control used here (analyst recommendation based on the article).
- Prioritise the review of Schneider Electric, Siemens and Rockwell equipment that is exposed or managed remotely, since the unit's access is documented against those brands (article).
- The article reports that the US federal government has urged owners and operators to take security measures against these attacks, and the French government has reserved the right to take further measures (article).
Linha do tempo
-
France attributes October sabotage of supermarket refrigeration controllers to Iran's Shahid Kaveh unit
ler a análise desta fonte ocultar
France's Cyber Crisis Coordination Centre (C4) attributes the October attacks on refrigeration controllers at more than 700 grocery stores to the IRGC cyber unit Shahid Kaveh, better known as CyberAv3ngers (article, citing the C4 report). The attacks affected Casino, Leclerc, Coopérative U, Metro, Carrefour and Intermarché groups, started at least 15 fires and caused food losses in the tens of millions of euros. Paris prosecutors say the attackers used Farsi and IP addresses linked to devices in Iran, and they are seeking international arrest warrants (pbs.org). The C4 report describes the campaign as the first cyber offensive carried out purely for sabotage on national territory, and no CVE or vendor advisory for the controllers was identified in the sources opened, so the public record is attribution-driven rather than vulnerability-driven.
Technical Details
- Since at least June 2024, the Shahid Kaveh unit has been able to scan, access and control industrial control equipment from Schneider Electric, Siemens and Rockwell (article).
- The infrastructure used for the October supermarket attacks was also used in the same period to run reconnaissance against Schneider Electric equipment, focused on small and medium energy and water production units (article).
- Temperatures reached 50°C (122°F) for about six hours, forcing stores to discard fresh food (pbs.org).
- Similar attacks on commercial refrigerators were reported in early November in Belgium, Ireland, Luxembourg and Sweden (article).
Remediation
- Owners and operators of refrigeration and other industrial controllers should confirm that no controller is reachable from the internet, and should restrict and monitor remote access paths, which the article describes as the means of control used here (analyst recommendation based on the article).
- Prioritise the review of Schneider Electric, Siemens and Rockwell equipment that is exposed or managed remotely, since the unit's access is documented against those brands (article).
- The article reports that the US federal government has urged owners and operators to take security measures against these attacks, and the French government has reserved the right to take further measures (article).