FRANCE ACCUSES IRANIAN REVOLUTIONARY GUARD OF CYBERATTACKS ON 700 REFRIGERATION SYSTEMS, TRIGGERING FIRES AND MAJOR FOOD LOSSES

PARIS, FRANCE — French authorities formally attributed a series of destructive cyberattacks targeting refrigeration controllers at approximately 700 retail sites to Iran’s Islamic Revolutionary Guard Corps (IRGC) on November 9, 2026. The attacks, carried out during the night of October 11–12, compromised industrial refrigeration controllers at supermarkets and food-processing facilities across France, causing extensive product losses and at least 15 reported fire outbreaks. French investigators identified Shahid Kaveh, a cyber-offensive unit operating under the IRGC’s Electronic and Cyber Center, as the organization responsible for executing the operation.

The attribution was published in a five-page technical intelligence report, CERTFR-2026-CTI-009, prepared by France’s Cyber Crisis Coordination Centre (C4). The interagency organization includes the National Cybersecurity Agency (ANSSI), the Armed Forces Cyber Command (COMCYBER), the Directorate General of Armaments (DGA), the Directorate General for External Security (DGSE), and the Directorate General for Internal Security (DGSI). Their investigation identified coordinated malicious activity targeting operational technology responsible for regulating refrigeration equipment throughout the country’s food distribution infrastructure.

According to the report, the attackers gained unauthorized access to refrigeration controllers and modified their defrost settings to unusually high temperatures. These alterations interfered with the equipment’s normal cooling operations, damaging refrigeration systems and causing substantial quantities of perishable food to become unusable. France’s Ministry for Europe and Foreign Affairs estimated the resulting food losses and physical damage at several tens of millions of euros. The affected businesses included major retail groups Casino, Leclerc, Coopérative U, Metro, Carrefour, and Intermarché, along with smaller butcher shops, a slaughterhouse, and cooperative food-processing facilities.

The manipulation of refrigeration equipment also created physical hazards beyond the destruction of stored food. French cybersecurity investigators documented at least 15 instances in which fires began during the attacks, demonstrating that unauthorized manipulation of industrial control systems can produce consequences extending beyond digital disruption. Unlike conventional ransomware operations focused on encrypting files or stealing information, this campaign involved direct interference with machinery that performs essential physical functions.

Investigators also discovered that several Schneider Electric industrial control devices installed at small hydroelectric facilities in France were targeted during the same period. The C4 linked this activity to the broader operation, although the effects on those installations were described as moderate. The simultaneous targeting of food refrigeration and electricity-related equipment indicates that the operation extended across multiple categories of industrial technology.

The French government’s technical assessment identified several indicators connecting the attacks to Shahid Kaveh. Investigators determined that infrastructure involved in the refrigeration intrusions had also been used to conduct reconnaissance against Schneider Electric equipment deployed in smaller energy and water production facilities. Investigators linked these activities to techniques previously associated with Shahid Kaveh, including the unit’s documented use of the Modbus industrial protocol over port 502 during reconnaissance operations in April 2026.

The investigation also identified use of the FOFA internet-connected device search platform during reconnaissance operations. Additional evidence included Farsi-language artifacts within the attackers’ infrastructure and publication of information concerning the refrigeration campaign on CyberbanNews, an online outlet associated with Shahid Kaveh, beginning October 13. French authorities assessed these technical and operational connections collectively when attributing the sabotage to the IRGC-linked unit.

Shahid Kaveh has previously operated through several online identities, including CyberAveng3rs, Soldiers of Solomon, Mr. Soul, and Cyber Isnaad Front. French intelligence identified Reza Salarvand and Mahdi Lashgarian as commanders of the unit, which has conducted operations targeting industrial control systems in the United States, Israel, France, and other European countries. Hamid Reza Lashgarian was identified as the head of the IRGC Electronic and Cyber Center overseeing the broader cyber organization.

The unit’s earlier activities included a November 2023 campaign targeting industrial control equipment manufactured by Israeli company Unitronics, whose systems are used in American and European infrastructure, including water-related facilities. Shahid Kaveh, operating through its CyberAveng3rs identity, publicly claimed responsibility for that campaign. The unit also claimed responsibility for industrial sabotage operations against Israeli and American interests in March and April 2026, including attacks involving Israeli refrigeration equipment.

According to the French report, Shahid Kaveh has possessed tools capable of scanning, accessing, and controlling industrial equipment manufactured by Schneider Electric, Siemens, and Rockwell since at least June 2024. Investigators documented the unit conducting large-scale reconnaissance against Schneider Electric devices in April 2026, including systems operating in France. These capabilities are relevant to understanding how attackers could identify exposed industrial controllers across multiple locations before attempting coordinated interference.

The French government also attributed separate cyber operations against national interests to Shahid Shoostari, another unit operating within the IRGC’s Electronic and Cyber Center. Also associated with Emennet Pasargad, the organization was linked to operations targeting French satirical publication Charlie Hebdo and a company managing digital advertising displays during the 2024 Paris Olympic and Paralympic Games.

In January 2023, attackers compromised and defaced Charlie Hebdo’s online store and extracted information from its database. French investigators linked the operation to Shahid Shoostari through technical infrastructure and evidence of coordinated online claims. Authorities also connected the unit to an earlier plan targeting the publication in 2020 following its republication of cartoons depicting the Prophet Muhammad.

During the summer of 2024, the same Iranian-linked unit compromised a French company operating digital video display systems. Investigators determined that the attackers attempted to replace legitimate advertising content with manipulated images criticizing Israeli athletes’ participation in the Paris Olympics. The intrusion was discovered before the unauthorized images could be displayed. Investigators subsequently traced related material to Persian-language social media accounts, an Iranian news website, and internet connections associated with Iranian service providers.

France’s Foreign Minister Jean-Noël Barrot publicly confirmed the government’s attribution of the October refrigeration attacks to the IRGC during a November 9 diplomatic meeting in Paris. The French government announced plans to summon Iran’s ambassador and propose additional European Union sanctions against individuals and organizations connected to the destructive campaign. France also reserved the option of taking further measures in response to the attacks.

The Paris Prosecutor’s Office opened a judicial investigation involving the leadership of Shahid Kaveh and additional suspected participants. Prosecutor Laure Beccuau indicated that international arrest warrants had been requested for the unit’s leader and two deputies, along with efforts to identify other individuals potentially involved. The criminal investigation is separate from the French government’s technical attribution and remains subject to the applicable judicial process.

French authorities have also been examining a separate series of refrigeration disruptions reported across Europe in early November, affecting businesses in multiple countries and facilities associated with France’s national blood service. Those incidents were not addressed in the November 9 technical report, and the French government has not established through that assessment that they were conducted by the same Iranian unit.

The October attacks represent a significant escalation in the physical consequences of cyber operations against commercial and industrial infrastructure. By remotely altering equipment settings, attackers disrupted food preservation, damaged business operations, and created fire hazards without requiring physical access to the affected facilities. The incident demonstrates the security exposure created when industrial control systems are accessible through networks that adversaries can identify and manipulate.

France’s investigation establishes a government-level attribution supported by technical evidence, historical operational patterns, and intelligence analysis. The findings identify Shahid Kaveh as the executing unit and the IRGC’s Electronic and Cyber Center as the broader organization responsible for the activity. Iran has historically denied involvement in malicious cyber operations, and no specific response to the November 9 French attribution was established in the initial reporting.

French Cyber Crisis Coordination Centre (C4) — “Activités cyber offensives menées par des acteurs iraniens liés au CGRI — Imputation d’attaques à but de sabotage et de déstabilisation ciblant la France” (Cyber Offensive Activities by Iranian IRGC-Linked Actors: Attribution of Sabotage and Destabilization Attacks Targeting France), Report CERTFR-2026-CTI-009, November 9, 2026. (Free Download)

🔥 NOW AVAILABLE! 🔥

‎👉 Eclipsera – Apple Music

Sponsored • TRJ Ads
Inquiries: contact@therealistjuggernaut.com

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE