France Attributes October 2026 Supermarket Refrigeration Sabotage to Iran’s IRGC Cyber Unit Shahid Kaveh

On 9 November 2026, France publicly attributed a wave of destructive cyberattacks against French interests to Iranian actors linked to the Islamic Revolutionary Guard Corps (IRGC).

The technical assessment comes from the Cyber Crisis Coordination Centre (C4), ANSSI, COMCYBER, the DGA, the DGSE and the DGSI, in CERT-FR report CERTFR-2026-CTI-009.

A parallel statement from the Ministry for Europe and Foreign Affairs says France is able to attribute the October sabotage to Iran and to the cyber-offensive unit Shahid Kaveh.

The October 2026 refrigeration sabotage

C4 says it was alerted on 12 October 2026 to an attack on cold controllers at about 700 large-retail sites in France.

Overnight from Sunday 11 to Monday 12 October, compromised equipment had its defrost settings forced to high temperatures, causing major merchandise losses and fires in at least 15 cases.

Named retail groups include Casino, Leclerc, Coopérative U, Metro, Carrefour and Intermarché.

Additional agri-food victims included several small butcheries, a slaughterhouse and cooperative food plants.

The Foreign Ministry estimates food losses at several tens of millions of euros and calls the campaign unprecedented in scale and aggressiveness, describing it as the first cyber-offensive campaign operated purely for sabotage on French national territory.

C4 also links concurrent targeting of Schneider Electric equipment at small French hydroelectric installations to the same attack, with moderate effects.

Who France names

The report says C4 can impute several destabilisation attacks on French interests to the IRGC Electronic and Cyber Centre (CGRI-CEC) units Shahid Shoostari and Shahid Kaveh.

For the refrigeration campaign, it presents a “faisceau d’indices” (bundle of indicators) pointing to the IRGC as sponsor and Shahid Kaveh as executor.

Shahid Kaveh is described as led by Reza Salarvand and Mahdi Lashgarian; an annex also names Hamid Reza Lashgarian as head of CGRI-CEC.

The unit’s public-facing avatars include CyberAveng3rs, Soldiers of Solomon, Mr. Soul and Cyber Isnaad Front, with CyberbanNews as a linked outlet.

Indicators cited for the October attack

• Attack infrastructure was also used in the same period for reconnaissance against Schneider Electric systems, using Modbus on port 502 techniques associated with Shahid Kaveh since at least April 2026.
• Operators used the FOFA scanning tool.
• CyberbanNews relayed the refrigeration attack from 13 October 2026.
• Farsi-language traces were found in the attack infrastructure.

The public PDF does not list CVE numbers, malware family names, or specific IP addresses for that campaign.

Earlier French cases attributed to Shahid Shoostari

C4 also attributes longer-running destabilisation activity to Shahid Shoostari, documented in open sources as Iliyanet or Emennet Pasargad, including Charlie Hebdo operations (2020 planning; 4 January 2023 online-shop defacement and database theft) and a July 2024 compromise of a French video-display company during Paris Olympics preparations, aimed at pushing photomontages against Israeli athletes’ participation before the boards were used.

That compromise was discovered before images were displayed.

The MFA notes EU sanctions in March 2026 against the Iranian entity it spells Emmenet Pasargad for prior operations.

French response

The Foreign Ministry says France will summon Iran’s ambassador in France, will propose new European sanctions against Iranian entities and individuals involved, and reserves further public and non-public measures under its 2026 national cybersecurity strategy.

Caveat

These findings are official French attribution and C4 imputation based on investigative indicators.

They are not independent forensic proof published in full in the five-page public report, which also contains no dedicated mitigation checklist.

Sources: CERTFR-2026-CTI-009; MFA attribution declaration.