France attributes October 2026 sabotage of ~700 supermarket refrigeration controllers to IRGC-linked Shahid Kaveh (CyberAv3ngers)

Linha do tempo

1. infosecurity-magazine.com ↗ · pub. 10/11/2026 07:35 · coletado 10/11 09:00

   France blames IRGC-linked Shahid Kaveh for October 2026 sabotage of supermarket refrigeration at about 700 sites

   The article adds the Paris prosecutor's public statement on the investigation's links to Shahid Kaveh and Shahid Shoostari, the CERT-FR naming of three IRGC and Shahid Kaveh leaders, and the government's statement that the campaign is the first cyber-offensive carried out purely for sabotage on French territory. It also says the government will press EU partners for sanctions and reserves further public and undisclosed measures. Finally, it states that the attribution excludes the early-November attack on the French Blood Service (infosecurity-magazine.com).

   ler a análise desta fonte ocultar

   The article adds the Paris prosecutor's public statement on the investigation's links to Shahid Kaveh and Shahid Shoostari, the CERT-FR naming of three IRGC and Shahid Kaveh leaders, and the government's statement that the campaign is the first cyber-offensive carried out purely for sabotage on French territory. It also says the government will press EU partners for sanctions and reserves further public and undisclosed measures. Finally, it states that the attribution excludes the early-November attack on the French Blood Service (infosecurity-magazine.com).

   French authorities attribute the 11-12 October 2026 cyber-attacks on refrigeration control systems at roughly 700 supermarket sites to Iranian state-linked actors. Paris Public Prosecutor Laure Beccuau said the investigation found links to Shahid Kaveh and Shahid Shoostari, which the article describes as elite offensive units tied to the Islamic Revolutionary Guard Corps (IRGC). A CERT-FR technical attribution notice published on 9 November links Shahid Kaveh to the hacktivist personas CyberAveng3rs, Soldiers of Solomon, Mr. Soul and Cyber Isnaad Front, and names three IRGC and Shahid Kaveh leaders. The evidence cited is IP addresses tied to Iran-based endpoints, Farsi words in the attackers' traces and tactics consistent with earlier Shahid Kaveh campaigns. The government will summon Iran's ambassador and press EU partners for sanctions, while the article gives no CVE, vulnerability or initial access vector for the attacks.

   Technical Details

   • The attacks targeted refrigeration control systems across about 700 supermarket sites, and the article calls the campaign unprecedented in scale and aggressiveness.
   • Attribution rests on IP addresses linked to Iran-based endpoints, Farsi text artefacts, and TTPs consistent with previous Shahid Kaveh campaigns.
   • CERT-FR places the case in a series of IRGC-linked incidents since at least 2020, including the 2023 destabilisation campaign against Charlie Hebdo and a 2024 campaign against a French digital display company during the Paris 2024 Olympic and Paralympic Games.
   • The article states that this attribution does not cover the cyber-attack on the French Blood Service (EFS) in early November.
2. thehackernews.com ↗ · pub. 10/11/2026 06:08 · coletado 10/11 07:00

   France attributes sabotage of refrigeration controllers at about 700 retail sites to IRGC unit Shahid Kaveh

   ler a análise desta fonte ocultar

   The French government has attributed an October 2026 sabotage campaign against refrigeration controllers at about 700 retail sites to Shahid Kaveh, a cyber unit of Iran's Islamic Revolutionary Guard Corps (IRGC) (thehackernews.com). On the night of October 11, attackers took remote control of Danfoss and Dixell controllers through their web interfaces, set abnormal defrost cycles at high temperatures, and disabled temperature safety alerts, causing food losses and fires. The Paris prosecutor's office opened a judicial investigation against the unit's head and two deputies and requested international arrest warrants, while the Foreign Ministry plans to summon Iran's ambassador and seek new EU sanctions. The same infrastructure was used for reconnaissance of Schneider Electric equipment at small hydroelectric sites, where the effects were moderate. The main limit on exposure is that the controllers were reachable from the internet, and CERT-FR says the campaigns were probably still underway.

   Technical Details

   • The attackers changed defrost settings to high temperatures and started defrost cycles with no time limit; the temperature probes' safety alerts, which should go off above a certain temperature, were switched off.
   • CERT-FR lists four product families affected by numerous compromises: Danfoss AK-SM and AK-SC series, Copeland xweb, and Dixell xweb.
   • Victims include large retailers such as Casino, Leclerc, Coopérative U, Metro, Carrefour and Intermarché, plus small butcher shops, a slaughterhouse and cooperative food plants.
   • Attribution rests on the reuse of the same infrastructure for reconnaissance of Schneider Electric equipment, reconnaissance techniques Shahid Kaveh has used since at least April, the FOFA scanning tool, Persian text in the attack infrastructure, and IP addresses leading to devices in Iran. The propaganda outlet CyberbanNews reported on the attack on October 13.
   • Shahid Kaveh has claimed earlier attacks on industrial equipment through the CyberAveng3rs persona, including a November 2023 campaign against Unitronics and a March–April sabotage campaign against Israeli and U.S. interests that hit industrial control equipment.
   • The article gives two figures for fires (at least 15 cases in one place, about 20 fires in another) and estimates food losses at several tens of millions of euros.

   Remediation

   According to the CERT-FR alert, as relayed by the article, last updated October 16:

   • Remove internet exposure from these units and from any unit reachable at a public IP address.
   • Check insurance contract terms before cutting off the data feed to the refrigeration contractor.
   • Review the full configuration, especially the defrost ranges.
   • Restore access only through a secure VPN or a protected network; filtering contractor IP addresses at a firewall is only an emergency measure.
   • Follow the maker's practices; for Danfoss devices, update firmware, set the security level to Strict and change default passwords.
   • For compromised controllers, restart Danfoss equipment or restore factory settings, then reconfigure the device before putting it back into service.
   • End-of-life devices with no security fixes remain at very high risk if exposed to the internet, and a factory reset alone will not stop recompromise.
3. securityonline.info ↗ · pub. 10/11/2026 06:26 · coletado 10/11 07:00

   France attributes October sabotage of refrigeration controllers at about 700 sites to IRGC unit Shahid Kaveh

   ler a análise desta fonte ocultar

   French authorities formally attributed the October 11-12 sabotage of remote refrigeration controllers to Shahid Kaveh, a unit the government links to the IRGC (thehackernews.com). The intrusions reached about 700 French retail sites, and the prosecutor's office said they caused food losses and about 20 fires (thehackernews.com). The attribution rests on four indicators gathered by the C4 cyber crisis coordination center, including reconnaissance infrastructure reused against Schneider Electric equipment at small hydroelectric sites, Persian-language traces and IP addresses leading to Iran (thehackernews.com). The Paris prosecutor opened a judicial investigation against the unit's head and two deputies and requested international arrest warrants, while the Foreign Ministry plans to summon Iran's ambassador and seek new EU sanctions (thehackernews.com). The government describes it as the first offensive cyber campaign on French soil carried out purely for sabotage (thehackernews.com; axios.com). The campaign relied on internet-exposed management interfaces and configuration weaknesses rather than a CVE-tracked flaw, and CERT-FR's alert, last updated October 16, warns that attacks were probably still underway (thehackernews.com).

   Technical Details

   • Operators reached Danfoss and Dixell controllers through their web interfaces, then started defrost cycles with no time limit and switched off the temperature probes' safety alerts (thehackernews.com).
   • CERT-FR's alert names four product families: Danfoss AK-SM and AK-SC series, Copeland xweb and Dixell xweb (thehackernews.com).
   • Reconnaissance used the FOFA scanning engine, and the same infrastructure scanned Schneider Electric equipment at energy and water sites; the techniques date to at least April (thehackernews.com).
   • Most victims were large French retailers, including Casino, Leclerc, Cooperative U, Metro, Carrefour and Intermarche, with small butcher shops, a slaughterhouse and food cooperatives also hit (thehackernews.com).
   • Effects on the hydroelectric Schneider Electric equipment were moderate (thehackernews.com).
   • Shahid Kaveh operates mostly through hacktivist personas such as CyberAveng3rs and Cyber Isnaad Front, which publicly claim some of its attacks (thehackernews.com); Axios adds Soldiers of Solomon (axios.com).
   • The unit previously claimed an industrial campaign against Unitronics in November 2023 and a March-April campaign against Israeli and U.S. industrial control equipment, including Israeli refrigeration equipment (thehackernews.com).

   Remediation

   • Remove internet exposure from affected controllers and from any unit reachable on a public IP address, and restore access only through a secure VPN or protected network (thehackernews.com).
   • Review the full configuration, especially defrost ranges, and check insurance terms before cutting the data feed to the refrigeration contractor (thehackernews.com).
   • For Danfoss devices, update firmware, set the security level to Strict and confirm default passwords are changed (thehackernews.com).
   • For compromised controllers, restart or factory-reset the device and reconfigure it before returning it to service; a reset alone does not remove the exposure of end-of-life devices, which CERT-FR says will almost certainly be compromised again (thehackernews.com).

   Conflicting Reports

   • The article says the Ministry summoned Iran's ambassador; The Hacker News reports the Foreign Ministry plans to do so (thehackernews.com). The later-dated source is the more precise one for the state of the action.
   • The article says the spread reached supermarkets in Belgium, Sweden and Luxembourg and blood transfusion facilities in France; the sources opened do not confirm either claim, and The Hacker News states the government attribution does not mention a separate wave in other European countries (thehackernews.com; axios.com).
   • The article says protective segmentation contained the hydroelectric intrusion before disruption; The Hacker News reports moderate effects on the Schneider Electric equipment (thehackernews.com).
   • The article says about fifteen fires; the prosecutor's office, as reported by The Hacker News, counts about 20 (thehackernews.com).
   • The article says the unit operates under the IRGC Cyber-Electronic Command; the sources opened name only the IRGC as sponsor and do not use that command name (thehackernews.com).
4. securityweek.com ↗ · pub. 10/11/2026 04:35 · coletado 10/11 05:00

   France attributes October supermarket refrigeration sabotage to Iran's IRGC-linked Shahid Kaveh unit

   ler a análise desta fonte ocultar

   On Monday 9 November 2026, France formally attributed the October 11–12 remote sabotage of supermarket refrigeration controllers to Shahid Kaveh, an offensive cyber unit of Iran's Islamic Revolutionary Guard Corps (IRGC), and opened a judicial investigation (aljazeera.com; axios.com). The campaign hit roughly 700 of France's 10,000 supermarkets, and the attackers pushed cabinet temperatures to about 50 °C for around six hours, forcing stores to discard fresh and frozen goods. Intermarché reported losses in the tens of millions of euros in a single day. French prosecutors are seeking international arrest warrants for the group's leader and his two deputies, and Paris plans European sanctions and has summoned Iran's ambassador. The article also links a second IRGC-affiliated group, Shahid Shoostari, to earlier attacks on Charlie Hebdo (2023) and the Paris 2024 Olympics, and reports a thwarted attack on French blood banks the same month. The rating is critical because the sabotage is confirmed and large-scale, although the article does not state the initial access vector.

   Technical Details

   • Attackers gained remote control of refrigeration controllers in hundreds of stores and independent shops across France in the early hours of 12 October, and the article gives no initial access vector.
   • Prosecutors named Danfoss and Dixell refrigeration controllers as the targeted products (thenationalnews.com).
   • France's Cyber Crisis Coordination Center (C4), which groups ANSSI, military cyber command and intelligence services, issued a five-page attribution report (sofx.com). It relied on Farsi-language artifacts, intrusion tooling, infrastructure matching earlier hacks by the unit, and IP addresses in Iran (sofx.com).
   • The propaganda outlet CyberbanNews, linked to Shahid Kaveh, publicized the refrigeration attacks on 13 October (bleepingcomputer.com).
   • CERT-FR says Shahid Kaveh works through hacktivist personas including CyberAveng3rs, Soldiers of Solomon, Mr. Soul and Cyber Isnaad Front (bleepingcomputer.com).
   • The same hackers reportedly targeted controllers at French hydroelectric sites, and that attack sparked at least 15 fires (sofx.com).
   • Its chief, Hamid Lashgarian, is under US sanctions with a $10 million reward offered for information (thenationalnews.com).

   Remediation

   • The article names no vendor advisory or fix. This research did not open a Danfoss or Dixell advisory, so the guidance below is general hardening, not a vendor fix.
   • Remove direct internet exposure of refrigeration controllers and their management interfaces, and place them behind segmented OT networks with VPN or jump-host access.
   • Replace default and weak credentials on controllers and remote management accounts, and enforce unique passwords with multi-factor authentication where the device supports it.
   • Alarm on abnormal cabinet temperature and on unexpected setpoint changes, and keep manual fallback procedures to limit spoilage.
   • Inventory exposed controllers and check the IP addresses and Farsi-linked activity described in the attribution against your logs.

   Conflicting Reports

   • The article dates the attack to 12 October. Axios and Al Jazeera place it on 11–12 October (axios.com; aljazeera.com).
5. theregister.com ↗ · pub. 09/11/2026 19:45 · coletado 09/11 21:00

   France attributes October sabotage of supermarket refrigeration controllers to Iran's Shahid Kaveh unit

   ler a análise desta fonte ocultar

   France's Cyber Crisis Coordination Centre (C4) attributes the October attacks on refrigeration controllers at more than 700 grocery stores to the IRGC cyber unit Shahid Kaveh, better known as CyberAv3ngers (article, citing the C4 report). The attacks affected Casino, Leclerc, Coopérative U, Metro, Carrefour and Intermarché groups, started at least 15 fires and caused food losses in the tens of millions of euros. Paris prosecutors say the attackers used Farsi and IP addresses linked to devices in Iran, and they are seeking international arrest warrants (pbs.org). The C4 report describes the campaign as the first cyber offensive carried out purely for sabotage on national territory, and no CVE or vendor advisory for the controllers was identified in the sources opened, so the public record is attribution-driven rather than vulnerability-driven.

   Technical Details

   • Since at least June 2024, the Shahid Kaveh unit has been able to scan, access and control industrial control equipment from Schneider Electric, Siemens and Rockwell (article).
   • The infrastructure used for the October supermarket attacks was also used in the same period to run reconnaissance against Schneider Electric equipment, focused on small and medium energy and water production units (article).
   • Temperatures reached 50°C (122°F) for about six hours, forcing stores to discard fresh food (pbs.org).
   • Similar attacks on commercial refrigerators were reported in early November in Belgium, Ireland, Luxembourg and Sweden (article).

   Remediation

   • Owners and operators of refrigeration and other industrial controllers should confirm that no controller is reachable from the internet, and should restrict and monitor remote access paths, which the article describes as the means of control used here (analyst recommendation based on the article).
   • Prioritise the review of Schneider Electric, Siemens and Rockwell equipment that is exposed or managed remotely, since the unit's access is documented against those brands (article).
   • The article reports that the US federal government has urged owners and operators to take security measures against these attacks, and the French government has reserved the right to take further measures (article).
6. olhardigital.com.br ↗ · pub. 09/11/2026 16:32 · coletado 09/11 18:00

   France attributes October supermarket refrigeration sabotage to Iran's IRGC-linked Shahid Kaveh unit

   ler a análise desta fonte ocultar

   The French government has attributed to Iran a cyberattack that remotely raised the temperature of supermarket refrigeration systems in France in October, causing fires and food losses. Foreign Minister Jean-Noël Barrot blamed the Islamic Revolutionary Guard Corps (IRGC) and said Iran's ambassador had been summoned, with diplomatic measures and sanctions to be pursued with the EU. The Paris Prosecutor's Office requested international arrest warrants against the head of Shahid Kaveh, an offensive cyber unit linked to the IRGC, and two of its deputies (olhardigital.com.br). Per the article, the first attribution came from Le Figaro citing anonymous sources, and it is part of a wider wave: similar attacks hit supermarkets in Sweden, Ireland, the Netherlands, Estonia, Finland, Belgium and Luxembourg on 2 November, and bomb-threat hoaxes disrupted flights. The full national report and the prosecutor's statement could not be retrieved in this research, so the attribution rests on the government's public claims as reported by the press.

   Technical Details

   • Per the Al Jazeera report (aljazeera.com), investigators say the attackers used Farsi and IP addresses linked to devices located in Iran, gained internet access to the refrigeration systems and remotely pushed temperatures to 50 °C overnight.
   • The French report, as summarised in search results from therecord.media, cites Farsi text artefacts, tooling and reconnaissance infrastructure, and names the unit's leadership in an annex. The full report was not opened during this research.
   • The article does not describe the initial access vector, the exploited vulnerabilities or the specific malware used.

   Remediation

   • The article and the sources reviewed do not describe defensive measures for operators of refrigeration or industrial control systems. Operators of building and refrigeration OT should review internet exposure of these controllers and their remote-access paths, which is a general recommendation and not a finding from the sources.
7. techcrunch.com ↗ · pub. 09/11/2026 16:19 · coletado 09/11 18:00

   France attributes mass hacks of supermarket freezer controllers and blood bank cold units to Iran's IRGC

   ler a análise desta fonte ocultar

   The French government has formally attributed to the Islamic Revolutionary Guard Corps (IRGC) a series of cyberattacks that hit thousands of internet-connected industrial refrigerated and freezer units in France and wider Europe. Two waves in October and November 2026 remotely accessed web-based controllers that manage cold-storage fleets at grocery stores and supermarkets and raised temperatures to spoil food. Medical blood banks were also targeted, but according to the French Blood Establishment the attacks were stopped before any blood was spoiled. French foreign minister Jean-Noël Barrot confirmed responsibility, Paris summoned Iran's ambassador, and France said it would seek European-wide sanctions against those responsible. The U.S. government reportedly links the attacks to pro-Iranian hacktivists working for Tehran, while the U.S. intelligence community has made no formal public attribution.

   Technical Details

   • The attackers remotely broke into web-based controllers that manage fleets of industrial cold and chilling units, then raised temperatures to spoil food and destroy goods.
   • Security researchers have warned that these web-based controllers are vulnerable to remote attacks, and some affected models made by Danfoss no longer receive security fixes.
   • The article gives no CVE identifiers, vulnerable firmware versions, or authentication and access prerequisites, so the exact entry point is not established.
   • U.S. officials are reportedly investigating whether freezer units on military bases were hacked, following similar outages earlier in 2026.
8. securityaffairs.com ↗ · pub. 09/11/2026 16:12 · coletado 09/11 18:00

   France attributes sabotage of supermarket refrigeration controllers to IRGC-linked Shahid Kaveh unit

   ler a análise desta fonte ocultar

   On 9 November 2026 the French government, through the Paris prosecutor's office and the Cyber Crisis Coordination Centre (C4), blamed the Islamic Revolutionary Guard Corps (IRGC) for sabotaging refrigeration controllers at about 700 French grocery sites on 11 and 12 October (therecord.media). The Shahid Kaveh cyber unit, tied to the IRGC Electronic and Cyber Center, was named as the operator, and the report's annex names its commanders (therecord.media). Foreign Minister Jean-Noël Barrot summoned Iran's ambassador and promised EU sanctions, while Paris prosecutors opened a judicial inquiry into the unit's head and two deputies and requested international arrest warrants (therecord.media). Iran routinely denies malicious cyber operations and had not responded to the allegations by the time of reporting (therecord.media). The attacks reportedly forced defrost cycles, destroyed perishable stock and started at least 15 fires (therecord.media). This is an official attribution rather than an independently verified finding, and no vendor advisory, CVE or patch is tied to the campaign in the sources reviewed, so defenders should rely on the generic CISA and FBI guidance.

   Technical Details

   • Five US federal bodies (CISA, FBI, HHS, USDA and DOT) issued a fact sheet on 5 November 2026 describing hostile activity against electronic temperature controllers and commercial refrigeration controllers in grocery stores and cold storage sites (gbhackers.com).
   • The fact sheet cites authentication bypass and arbitrary code injection as possible exploitation paths, but it names no specific vulnerability and no affected manufacturer (gbhackers.com).
   • Successful intrusion would let an attacker change settings remotely and push units into heating or defrost cycles, with consequences such as inventory loss, fire hazards and operators losing sight of real temperatures (gbhackers.com).
   • French investigators tied the campaign to Shahid Kaveh through Farsi text artefacts, tooling and infrastructure used to scout other industrial equipment (therecord.media).
   • ANSSI also reported that the same actors targeted Schneider Electric equipment at several small hydroelectric facilities, with moderate disruption (therecord.media).
   • US agencies had earlier identified Shahid Kaveh as another name for CyberAv3ngers, a group linked to disruptive attacks on operational technology across US critical infrastructure (therecord.media).
   • ANSSI attributes earlier French incidents to Shahid Shoostari, also known as Emennet Pasargad, including a defacement of the Charlie Hebdo website and an attempt to hijack Paris Olympics display screens in 2024 (therecord.media).

   Remediation

   • Remove refrigeration and temperature controllers from direct internet exposure; where remote access is required, route it through a protected, updated firewall or edge device (gbhackers.com).
   • Place operational technology on dedicated network segments separated from business systems (gbhackers.com).
   • Replace default passwords, enforce strong credentials, adopt phishing-resistant multifactor authentication where feasible, update firmware and replace unsupported devices (gbhackers.com).
   • Restrict who can change settings with device and IP allowlisting (gbhackers.com).
   • Keep tested offline backups, review logs and set safe operating limits with alerts on deviations; report suspicious activity to CISA or the FBI (gbhackers.com).

   Conflicting Reports

   • Scope of the second wave: the article says at least nine other European countries reported freezer attacks on 2 November, while therecord.media reports at least 11 European countries (therecord.media). The Record's count is the more specific figure, but neither source gives a per-country list.
   • Fires: the article says fires broke out in several stores, while therecord.media reports at least 15 fires attributed to the French government's report (therecord.media).
   • Earlier incident: the article describes a 2023 breach of an online store attributed to Emennet Pasargad, while therecord.media describes Emennet Pasargad's activity against Charlie Hebdo as a website defacement and gives no 2023 store breach (therecord.media).
9. bleepingcomputer.com ↗ · pub. 09/11/2026 15:32 · coletado 09/11 16:00

   France attributes October supermarket refrigeration sabotage, with fires, to IRGC-linked Shahid Kaveh unit

   ler a análise desta fonte ocultar

   In a statement issued Monday, France's Ministry for Europe and Foreign Affairs attributed the October 11–12 attacks on industrial refrigeration controllers to Shahid Kaveh, a cyber-offensive unit affiliated with the electronic and cyber center of the IRGC. The intruders remotely set defrost settings to high temperatures, spoiling food at roughly 700 retail locations and sparking at least 15 fires, and French authorities put the food losses in the tens of millions of euros. The attribution comes from France's Cyber Crisis Coordination Center (C4), and the technical report was published by CERT-FR. France will summon Iran's ambassador and propose new EU sanctions, but it has attributed only the October attacks on French sites to Iran, not the November wave that hit more than 115 stores across six European countries. The article also ties attacks on Schneider Electric equipment at small hydroelectric installations to the same campaign and describes their effects as moderate. Criticity is critical because the campaign is confirmed, large-scale and has caused physical damage, although no CVE or vendor severity applies and the article does not describe the intrusion prerequisites.

   Technical Details

   The CERT-FR technical report and the FBI and CISA warning were not opened during the research, so these details rest on the article and on search excerpts.

   • The attackers compromised industrial refrigeration controllers and remotely changed defrost settings to high temperatures during the night of October 11–12.
   • CERT-FR lists Casino, Leclerc, Coopérative U, Metro, Carrefour and Intermarché among the affected retailers, along with butcher shops, a slaughterhouse and cooperative food-processing facilities.
   • Attribution indicators named by French investigators include the propaganda outlet CyberbanNews, which relayed the refrigeration attacks on October 13, 2026, the use of the FOFA internet-connected device search platform, which CERT-FR says the group commonly uses, and traces of Farsi-language content in the attacker's infrastructure.
   • The same infrastructure was used for reconnaissance of Schneider Electric industrial systems, using techniques previously associated with the unit.
   • CERT-FR says Shahid Kaveh operates through the hacktivist identities CyberAveng3rs, Soldiers of Solomon, Mr. Soul and Cyber Isnaad Front, and claimed a sabotage campaign against Israeli and US interests in March and April 2026, including Israeli refrigeration equipment.
   • A similar incident altered temperature and defrost settings at three facilities of France's national blood service. The article does not attribute it to Iran.
   • The article reports that the FBI and CISA warned last week of ongoing attacks on industrial refrigeration and cold-chain monitoring systems worldwide.

   Remediation

   No vendor or CERT-FR remediation guidance is named in the article, and the research did not open a source that provides it, so this section is omitted.

   Conflicting Reports

   • The article's earlier BleepingComputer estimate of 250 to 350 French supermarkets is superseded by the French authorities' figure of approximately 700 retail locations.
   • A search excerpt from aljazeera.com describes the hack as having hit more than 1,000 stores. The pages opened did not confirm that count, so the French figure of about 700 is kept as the more authoritative one.
10. cert.cyber.gouv.fr ↗ · pub. 08/11/2026 21:00 · coletado 09/11 14:01 primeiro registro

    Iran-linked IRGC cyber units behind destabilizing attacks on French industrial refrigeration controllers

    ler a análise desta fonte ocultar

    The Centre de Coordination des Crises Cyber (C4), an inter-ministerial body grouping ANSSI, COMCYBER, DGA, DGSE and DGSI, attributes a series of destabilization attacks against French interests to the Shahid Shoostari and Shahid Kaveh cyber-offensive units. These units operate within the CGRI-CEC, the electronic and cyber centre of Iran's Islamic Revolutionary Guard Corps. The most recent case, on 11 and 12 October 2026, targeted French industrial refrigeration controllers, which CERT-FR judges unprecedented in scale and aggressiveness. The report places it in a longer pattern observed since at least 2020, including attacks against Charlie Hebdo in 2023 and a French video display advertising company in 2024 linked to the Paris 2024 Olympic and Paralympic Games. The article names no CVE, malware, IOC, initial access vector or vendor, so defenders have no direct technical indicator to act on. Criticity is high because a state-linked actor is targeting industrial control equipment, but the article describes no confirmed compromise mechanism or public exploit.