Paris attributed the Oct. 11-12 sabotage of about 700 sites to IRGC unit Shahid Kaveh and asked for arrest warrants. It pointedly did not attribute the November wave that hit the rest of Europe.
France did something on Nov. 9 it had done exactly once before: it named a foreign state’s cyber unit, in public, on the strength of its own intelligence. The target was Iran, and the case was the supermarket refrigeration cyberattack that spoiled food across the country in October.
The unit is Shahid Kaveh, part of the electronic and cyber center of Iran’s Islamic Revolutionary Guard Corps. The operation ran the night of Oct. 11-12, when defrost settings on refrigeration controllers at about 700 French retail sites were pushed to high temperatures.
Read: Hackers Turned French Supermarket Freezers Into Ovens Overnight
The Centre de Coordination des Crises Cyber, the interministerial body that pulls together the national cyber agency ANSSI, the military cyber command COMCYBER, the armament directorate DGA and the DGSE and DGSI intelligence services, published its attribution report the same day the Foreign Ministry issued the political statement.
Most of the coverage skipped the next part. France attributed the French wave in October. It did not attribute the much larger European wave of Nov. 2-3, and it did not attribute the incident at the French blood service. Those remain open, and at least one vendor research team thinks the evidence points somewhere else entirely.
What France’s attribution report says
The report is four pages and unusually blunt for a French government document.
Compromised sites were mostly large retail: the C4 names Casino, Leclerc, Coopérative U, Metro, Carrefour and Intermarché. Beyond the chains, it lists several small butchers, an abattoir and cooperative food-processing plants. Changing the defrost parameters caused what the report calls significant merchandise losses and, in at least 15 cases, fires. The Foreign Ministry put the loss at several tens of millions of euros and called it the first offensive cyber campaign run purely for sabotage on French soil.
The retail damage was the visible half. The C4 also observed concurrent targeting of Schneider Electric equipment at small French hydroelectric installations, which it ties to the same operation. Effects there were moderate. Nobody lost power. But a unit that reaches small hydro in the same week it reaches grocery freezers is not optimizing for spoiled yogurt.
The attribution rests on four strands, and the report lists them plainly:
- The infrastructure used in the attack was also used, in the same period, for reconnaissance against Schneider Electric gear in small water and energy production sites.
- That reconnaissance used Modbus on port 502, a technique the C4 has tracked to Shahid Kaveh since at least April 2026.
- The operators used FOFA, the scanning service the unit habitually uses.
- CyberbanNews, the unit’s propaganda outlet, relayed the attack on Oct. 13, and Farsi-language traces were recovered from the attack infrastructure.
None of those is conclusive alone. Infrastructure gets shared, FOFA is a commercial service, and a persona claiming an attack proves nothing. Taken together, with the Modbus tradecraft as the anchor, they are a reasonable basis for a state attribution. They are also, notably, the kind of evidence a government can publish without burning much.
Shahid Kaveh is CyberAv3ngers, and it has been doing this for three years
If the unit name is unfamiliar, the personas will not be. The C4 lists CyberAveng3rs, Soldiers of Solomon, Mr. Soul and Cyber Isnaad Front as digital avatars of the same unit, with CyberbanNews as its mouthpiece.
CyberAv3ngers is the crew that compromised at least 75 U.S.-based Unitronics PLCs in November 2023, most of them in the water sector. A joint advisory from the FBI, CISA, NSA, EPA, DOE, Cyber Command and Treasury, first published in April 2026 and updated in July, tracks the same actor under Hydro Kitten, Storm-0784, Bauxite and UNC5691, and documents Iranian-affiliated exploitation of Rockwell CompactLogix and Micro850, Schneider Modicon M340 and Siemens S7-1200 controllers across government, water and energy targets. The ports in that advisory are 44818, 2222, 102 and 502.
The C4 adds a detail the U.S. advisory does not: Shahid Kaveh has held scripts to scan, access and control Schneider Electric, Siemens and Rockwell equipment since at least June 2024, and it claimed a large-scale sabotage campaign against Israeli and American industrial control systems – including Israeli refrigeration equipment, in March and April 2026.
So the October operation was not a new capability. It was the same capability pointed at France, six months after a dry run against the same equipment class in Israel.
The report’s annex names three men: Hamid Reza Lashgarian as head of the IRGC-CEC, and Mahdi Lashgarian and Reza Salarvand as Shahid Kaveh commanders. The Paris prosecutor’s office opened a judicial investigation into all three plus unidentified others, and asked for international arrest warrants. The investigation is run by the national police cybercrime office, OFAC, and the DGSI.
The way into the refrigeration controllers was a login page
Strip out the geopolitics and the tradecraft is mundane.
ANSSI’s assessment of the French cases points to exposed administration interfaces and weak passwords. Not an exploit chain. Not a zero-day. A web interface on the public internet with a password someone could guess.
This matters because there was a plausible exploit path available and the attackers did not need it. Claroty’s Team82 published three flaws in the Danfoss AK-SM 800A in August: CVE-2025-41450, an undocumented “code-of-the-day” authentication bypass rated CVSS 8.2; CVE-2025-41451, a post-authentication command injection at 7.6; and CVE-2025-41452, a configuration-injection issue at 5.4. Team82 counted 2,765 internet-exposed AK-SM 800A devices in a Censys scan. Danfoss fixed them in firmware R4.3.1.
Per SentinelLabs’ reading of the CERT-FR material, ANSSI did not find those vulnerabilities in the French intrusion path. The controllers in scope across the incidents include Danfoss AK-SM and AK-SC, Copeland and Dixell XWEB. Danfoss told AFP that most of the affected equipment is legacy and no longer receives software or security updates.
Legacy, internet-facing, unpatchable, and holding the safety envelope for a building full of food. That is the actual finding, and it has nothing to do with Iran.
Why the November wave is a separate question
On Nov. 2-3, refrigeration incidents hit supermarkets across Belgium, Luxembourg, the Netherlands, Sweden, Ireland, Estonia, Germany, Italy, Portugal and Finland, most inside a 24-hour window, with some units driven to 50 degrees Celsius (122 Fahrenheit). Three French blood-storage sites had temperature and defrost settings altered on Nov. 3 through an equipment supplier. Two days later, CISA, the FBI, HHS, USDA and the Department of Transportation issued a joint advisory telling operators to pull refrigeration controllers off the public internet.
France attributed none of that.
SentinelLabs assessed the European incidents and declined to name anyone. It treats Russian-aligned groups (specifically CARR, also tracked as Z-Pentest, and NoName057(16)) as credible candidates, alongside copycats and financially motivated intruders, and says the public record does not support attribution either way. NoName057(16) has claimed to hold Danfoss-associated credentials; Z-Pentest has claimed refrigeration access at a Spanish supermarket. Neither claim has been verified, and the French case contradicts both.
There is also a honeypot data point worth knowing. Lupovis logged more than 276 attempts from 91 distinct actors against Danfoss controller components over 10 days in late October, peaking on Oct. 26, and recorded none of that activity on its sensors outside Europe. Whoever ran the October French operation, the subsequent probing was a crowd.
The analytically honest position is that France has made a specific, evidenced claim about one night in October, and that everything after Nov. 1 is unresolved. Treating “Iran attacked Europe’s fridges” as settled is exactly the kind of compression that makes attribution less useful over time.
What changed politically
France has avoided public attribution for years, on the standard argument that naming a state is a political act and showing evidence costs intelligence. The doctrine broke in April 2025, when Paris publicly blamed Russia’s GRU and APT28 for the 2015 TV5MONDE sabotage and the 2017 Macron leaks. Iran is the second.
The measures announced are modest: the Iranian ambassador summoned, new EU sanctions proposed against entities and individuals, and a reservation of the right to take further public and non-public action. Foreign Minister Jean-Noël Barrot confirmed the attribution at a G7 meeting and described the sabotage as unprecedented in scale and aggressiveness.
The EU already sanctioned the other unit in this story. On March 16, 2026, the Council listed Emennet Pasargad, which the C4 identifies as Shahid Shoostari and which is also tracked as Iliyanet, over the Charlie Hebdo subscriber-data theft, interference attempts in U.S. elections, a Swedish SMS compromise that generated roughly 15,000 threatening messages after Quran burnings, and the 2024 Olympics display-board intrusion. The C4 report confirms that last one in detail: a French video-display operator compromised from July 20, 2024, photomontages targeting Israeli athletes first posted July 24 on a Persian-language Instagram account and relayed by an Iranian newspaper, caught before anything reached a screen.
Sanctioning an IRGC unit changes very little for the unit. What sanctions and arrest warrants do is build a public record, and a public record is what makes the next attribution cheaper to issue.
Iran had not responded publicly as of Nov. 10.
