France Attributes Refrigeration Controller Attacks to Iran's IRGC Unit Shahid Kaveh

France has formally named Iran as the sponsor of the October attack on refrigeration controllers that the Red Tiger team has been tracking. On 9 November 2026, France's Cyber Crisis Coordination Centre (C4), which brings together the national cybersecurity agency ANSSI, cyber command, the defence procurement agency and both intelligence services, published report CERTFR-2026-CTI-009. It attributes the attack to Shahid Kaveh, a unit of the electronic and cyber centre of Iran's Islamic Revolutionary Guard Corps (IRGC). On 10 November the French foreign ministry called it the first offensive cyber campaign carried out purely for sabotage on French soil, with damage in the tens of millions of euros.

What happened

According to the report, during the night of 11 to 12 October 2026 attackers compromised the refrigeration controllers at about 700 grocery retail sites in France. They changed the defrost settings to high temperatures. That caused heavy stock losses and, in at least 15 cases, fires. The C4 also knows of victims in the food sector, including small butcher shops, a slaughterhouse and cooperative food plants. At the same time, Schneider Electric equipment at small French hydroelectric sites was targeted, with moderate effects. The C4 links that activity to the same attack.

Who is behind it

The report says Shahid Kaveh is led by Reza Salarvand and Mahdi Lashgarian. It mostly works behind hacktivist personas, including CyberAveng3rs, Soldiers of Solomon, Mr. Soul and Cyber Isnaad Front, and it uses CyberbanNews as its propaganda outlet. Through CyberAveng3rs it claimed the November 2023 campaign against Unitronics controllers, which hit water systems in the United States, and it claimed sabotage of Israeli refrigeration equipment in March and April 2026. Since at least June 2024 it has had scripts to scan, access and control Schneider Electric, Siemens and Rockwell equipment. In April 2026 it ran mass reconnaissance against Schneider Electric controllers over Modbus on port 502, including in France.

The evidence the C4 cites: the attack infrastructure was also used to scan Schneider Electric equipment at small energy and water producers. the operators used the FOFA internet scanning tool the unit is known for. CyberbanNews relayed the attack on 13 October. and traces of Farsi were found in the attack infrastructure. The report also attributes earlier destabilization attacks on France since 2020 to a second IRGC unit, Shahid Shoostari, known in open sources as Emennet Pasargad.

What this means for operational technology (OT) owners

This is no longer a mystery hacktivist wave. A state military unit with tooling for three of the most common controller brands in Western plants caused physical damage by changing setpoints on internet-reachable controllers. Water, small hydro, food and cold storage were all in scope. The report covers the October attack only and does not say whether later incidents in the campaign were the same unit.

What to do now

1. Find every internet-reachable controller, panel and remote access path at your sites, including those your refrigeration, building or energy contractor manages, and take them off the public internet.
2. Block Modbus on port 502 and other industrial protocols at the site edge, and alert on any inbound industrial protocol traffic from outside.
3. Set safe limits on critical setpoints such as defrost temperature in the controller itself where possible, with alarms that reach a person overnight.
4. Brief your team that this unit uses hacktivist names, so a claim by one of these personas should be treated as a state-backed threat and reported to your national cyber agency.

Prior Red Tiger advisories on this campaign: https://www.redtigersecurity.com/advisory/european-supermarket-refrigeration-attacks . https://www.redtigersecurity.com/advisory/uk-food-supply-refrigeration-attacks . https://www.redtigersecurity.com/advisory/french-blood-bank-refrigeration-attack . https://www.redtigersecurity.com/advisory/us-refrigeration-cold-chain-csa

We are here to help, so check out our resources online at www.redtigersecurity.com and book a follow-up call with our team if you have any questions: https://calendly.com/jonathanpollet/30min

Sources: CERT-FR and C4 report CERTFR-2026-CTI-009 (9 November 2026, TLP:CLEAR, in French) https://www.cert.cyber.gouv.fr/uploads/CERTFR-2026-CTI-009.pdf ; French Ministry for Europe and Foreign Affairs attribution statement (10 November 2026) https://www.diplomatie.gouv.fr/en/presse-et-ressources/decouvrir-et-informer/actualites/declaration-d-attribution-a-l-iran-de-cyberattaques-visant-la-france