France has blamed Shahid Kaveh, an offensive cyber unit of Iran’s Islamic Revolutionary Guard Corps, for the sabotage of refrigeration controllers at about 700 French retail sites on the night of October 11. The Foreign Ministry said on November 9 that it would summon Iran’s ambassador and propose new European sanctions, calling the attack the first offensive cyber campaign on French soil carried out purely for sabotage.
The ministry said the attack caused fires, considerable material damage and food losses estimated at several tens of millions of euros. A joint report published the same day by the government’s cyber crisis coordination center, known as C4, says the attackers changed the controllers’ defrost settings to high temperatures, causing heavy losses of goods and, in at least 15 cases, fires. Most of the victims were large retailers, including Casino, Leclerc, Coopérative U, Metro, Carrefour and Intermarché. Small butcher shops, a slaughterhouse and cooperative food plants were also hit.
The C4, which brings together the national cybersecurity agency ANSSI, the DGSE and DGSI intelligence services, the armament directorate and the military’s cyber command, also linked the attack to the simultaneous targeting of Schneider Electric equipment at several small hydroelectric plants in France. The effects on that equipment were moderate, it said.
The report cites four indicators. The attack infrastructure was used in the same period to probe Schneider Electric equipment at small energy and water production sites, with techniques the unit has used since at least April. The operators used FOFA, a scanning tool the group habitually relies on. CyberbanNews, a propaganda outlet associated with the unit, publicized the attack as early as October 13. Traces of Farsi were found in the attack infrastructure.
According to the report, Shahid Kaveh is led by Reza Salarvand and Mahdi Lashgarian and is known mainly through hacktivist personas, including CyberAveng3rs and Cyber Isnaad Front. As CyberAveng3rs, it claimed a November 2023 campaign targeting Unitronics, an Israeli maker of industrial control systems. In March and April, it claimed sabotage against Israeli and US interests that hit industrial equipment, including Israeli refrigeration systems.
Paris prosecutor Laure Beccuau said her office opened a judicial investigation on November 9 targeting the unit’s leader, his two deputies and anyone else identified, and is seeking international arrest warrants. Investigators found the use of Farsi and IP addresses linked to devices in Iran, she said. “This is an attack of unprecedented scale and aggressiveness,” Foreign Minister Jean-Noël Barrot said. “That is why it will not go unanswered.”
Iran’s Foreign Ministry rejected the accusations as unfounded in a statement on social media on November 10, the Spanish news site Demócrata reported.
The C4 report also attributes earlier operations against France, including attacks on Charlie Hebdo in 2023 and on a French video display company during the 2024 Paris Olympics, to another unit of the Guard’s electronic and cyber center, Shahid Shoostari, also known as Emennet Pasargad. The European Union sanctioned Emennet Pasargad in March.
Supermarkets in Sweden, Belgium, Luxembourg, Ireland and Estonia reported similar refrigeration incidents on November 2, and five US agencies warned on November 5 that refrigeration and cold-chain monitoring systems were being targeted worldwide.
Sources: French Foreign Ministry, CERT-FR (C4 report), SecurityWeek
–
By the Control Plane Editorial Team