Threat intel

On November 9, France formally blamed Iran's Islamic Revolutionary Guard Corps (IRGC) for the overnight attack of October 11 to 12 that pushed refrigeration in about 700 French retail sites into high-temperature defrost. Foreign Minister Jean-Noël Barrot announced the attribution on the sidelines of the G7 foreign ministers' meeting in Paris, summoned Iran's ambassador and said France would seek sanctions at European level. The same day, Paris prosecutor Laure Beccuau opened a judicial investigation into the head of the IRGC unit Shahid Kaveh and his two deputies, and her office requested international arrest warrants for them.

The technical case comes from a five-page report by France's Centre de Coordination des Crises Cyber (C4), published by CERT-FR as CERTFR-2026-CTI-009. It names three IRGC officers, ties the supermarket attack to concurrent probing of small hydroelectric plants, and lists the evidence. Anyone running refrigeration controllers, or Schneider Electric gear in small energy or water sites, is in the target set the report describes.

What France announced

The C4 groups France's cyber agency ANSSI, military cyber command, armament agency and both intelligence services. Its report attributes the October attack to Shahid Kaveh, an offensive unit inside the IRGC's Electronic and Cyber Centre (IRGC-CEC), with the IRGC as sponsor. An annex names Hamid Reza Lashgarian as head of the IRGC-CEC and Mahdi Lashgarian and Reza Salarvand as commanders of Shahid Kaveh.

Two of those names are not new. The US Treasury sanctioned Hamid Reza Lashgarian and Mahdi Lashgarian on February 2, 2024, along with four other IRGC-CEC officials, over the November 2023 defacement of Unitronics programmable logic controllers (PLCs), small industrial computers used in water and other infrastructure. The C4 says Shahid Kaveh claimed that campaign as CyberAveng3rs. Salarvand was not on the Treasury list.

The prosecutor did not name the three warrant targets publicly. Reports of the case describe the suspected offences as organised cybercrime, with the aggravating circumstance of acting in the interest of a foreign power. Nobody is in custody, and an arrest would only happen if one of the officers travelled to a country that honours the warrants.

The report also pins two earlier operations on a second IRGC-CEC unit, Shahid Shoostari (Emennet Pasargad in open sources): the 2023 breach of Charlie Hebdo's online shop and a July 2024 attempt to hijack video kiosks during the Paris Olympics.

How the attack worked

The targets were remote management controllers for commercial refrigeration. CERT-FR's alert of October 12 (CERTFR-2026-ALE-012) lists Danfoss AK-SM and AK-SC series system managers and the Copeland and Dixell XWEB supervisors. These boxes run every case and cold room in a store and are often left reachable from the internet so the refrigeration contractor can maintain them remotely.

The attackers did not deploy malware or encryption. Through the controllers' web interfaces, they changed the defrost parameters so units heated to high temperatures and stayed there, and according to the French reporting they also switched off temperature alarms. The C4 counts significant stock losses and at least 15 fires. Affected companies include Casino, Leclerc, Coopérative U, Metro, Carrefour and Intermarché, plus small butchers, a slaughterhouse and cooperative food plants.

The C4 rests the attribution on four indicators taken together:

• The attack infrastructure was also used in the same period to scan Schneider Electric equipment in small energy and water production sites over Modbus on TCP port 502, a technique Shahid Kaveh has used since at least April 2026. Modbus is an industrial protocol with no authentication, so any host that can reach port 502 can read and write the device's registers.
• The operators used FOFA, a commercial search engine for internet-exposed devices that the group uses habitually.
• CyberbanNews, a propaganda outlet tied to the unit, relayed the attack from October 13.
• Traces of Farsi were found in the attack infrastructure.

Anyone can subscribe to FOFA and language traces can be planted, so the infrastructure overlap carries most of the weight. The report gives no confidence levels or indicators of compromise, so defenders cannot match it against their own logs.

The wider campaign

The report says Shahid Kaveh has had scripts to scan, access and control Schneider Electric, Siemens and Rockwell equipment since at least June 2024. It operates behind hacktivist personas, including CyberAveng3rs, Soldiers of Solomon, Mr. Soul and Cyber Isnaad Front, and in March and April 2026 claimed sabotage of Israeli and American industrial equipment, Israeli refrigeration among it. During the October attack, the C4 also saw Schneider Electric devices at several small French hydroelectric plants targeted, with "moderate" effects.

The attribution covers French territory only. Supermarkets in at least nine other European countries reported a similar freezer attack on November 2, and three sites of the French blood service EFS saw cold room settings changed through a contractor the same day. Neither has been attributed to Iran. On November 5, CISA, the FBI and three other US departments published a fact sheet on attacks against refrigeration and cold chain controllers that names no vendor or attacker.

What to do

1. List every refrigeration controller and supervisor you own, including those your contractor installed: Danfoss AK-SM and AK-SC, Copeland XWEB, Dixell XWEB and anything similar. Ask the contractor how they connect to each one.
2. Check exposure from outside. Search your public IP ranges in Shodan or Censys for the controllers' web interfaces, and for TCP 502 if you run Schneider or other Modbus devices. Anything that answers needs to come off the internet. CERT-FR advises checking your insurance contract before cutting the contractor's data feed.
3. Restore remote access only through a VPN or a protected network. CERT-FR accepts a firewall rule limited to the contractor's source addresses as a stopgap, not a fix.
4. Harden what stays. For Danfoss, CERT-FR says to update the firmware, set the security level to Strict and confirm default passwords are changed. Dixell has published guidance for securing XWEB supervisors. Replace end-of-life units: CERT-FR calls an exposed, unpatched controller a very high risk.
5. Look for tampering. Compare defrost schedules, setpoints and alarm thresholds with the contractor's baseline, and check that alarms still reach someone. Review controller user accounts and firewall logs for connections to the management interface from unfamiliar addresses, around October 11 to 12 and November 2 in particular.
6. If a unit was changed, take it offline from the internet, restart it and, for Danfoss, factory reset it if a restart does not clear the change. A reset removes persistence but not the weakness, so reconfigure and harden it before it goes back into service.
7. Follow the CISA fact sheet's last point: configure controllers so they cannot drive equipment past safe temperature limits, whoever sends the command.

Operators of small hydro, water or energy sites should apply the same steps to Schneider Electric PLCs and block Modbus TCP 502 at the perimeter, since the C4 ties that reconnaissance to the same infrastructure.

Why the warrants matter to defenders

Warrants and sanctions will not stop Shahid Kaveh from scanning. They do remove the hacktivist cover: in France's view, a CyberAveng3rs or Cyber Isnaad Front claim against a retailer or utility is an IRGC operation. The unit found its French targets with an internet device search engine, which suggests exposure alone was enough to be picked. Refrigeration and small plant controllers belong in the asset inventory and the external exposure scans alongside firewalls and VPNs.

Our attack surface management service finds controllers and Modbus devices exposed on your address ranges, and safeguarding and hardening covers moving contractor access behind a VPN. If you are not sure what your refrigeration contractor has left on the internet, open the chat and Yaali, our AI agent, will pass the question to an engineer.

---

Sources: CERT-FR CERTFR-2026-CTI-009 (C4 attribution report), CERT-FR alert CERTFR-2026-ALE-012, France 24, The National News Desk via KMPH, CircleID, Cyberattaque.org, The French Spy, US Treasury, February 2, 2024, CISA fact sheet on refrigeration and cold chain systems, Security Affairs.