www.it-connect.fr
France Accuses Iran’s Revolutionary Guards of Hacking Fridges
Cold controllers reprogrammed to defrost at high temperatures, around 700 retail sites affected, and at least 15 fires started. One month after the October 12, 2026 cyberattack, the French state has officially named the perpetrators: a cyber unit of Iran’s Revolutionary Guards. Here’s what you need to know.
On November 9, 2026, the Cyber Crisis Coordination Center (C4), which brings together ANSSI, COMCYBER, DGA, DGSE and DGSI, published a report on several cyberattacks, including those targeting DANFOSS equipment. The report attributes several attacks against France to two units of the Electronic and Cyber Center of the Islamic Revolutionary Guard Corps (IRGC-CEC): Shahid Kaveh and Shahid Shoostari.
"The attack targeting French industrial refrigeration controllers on October 11 and 12, 2026 constitutes an unprecedented attack by its scale and level of aggressiveness.", the document states. At the same time, the Paris prosecutor’s office opened a judicial investigation targeting the head of Shahid Kaveh and his two deputies, with a request for international arrest warrants.
Shahid Kaveh: From Modbus Scanning to Fridge Sabotage
On the night of October 11 to 12, 2026, the attackers modified the defrost settings of refrigeration controllers at around 700 sites, setting them to high temperatures. The C4 cites the Casino, Leclerc, Coopérative U, Metro, Carrefour and Intermarché groups, as well as butcher shops, a slaughterhouse and food-processing plants. It also links the targeting of Schneider Electric equipment in small hydropower installations to the same operation, with more limited effects.
Led by Reza Salarvand and Mahdi Lashgarian, the Shahid Kaveh unit operates behind hacktivist aliases, including CyberAv3ngers, which claimed responsibility in November 2023 for the campaign against Israeli Unitronics PLCs. If the French state attributes the attacks to this group, it is for several reasons:
- Shared infrastructure: the same infrastructure was used for reconnaissance against Schneider Electric equipment in energy and water production facilities, via the Modbus protocol on port 502 (a technique observed in Shahid Kaveh since April 2026).
- Scanning tool: the operators used FOFA, which is typical for them.
- Claim of responsibility: the attack was relayed on CyberbanNews, the group’s propaganda outlet, as early as October 13, 2026.
- Language: traces of Farsi were found in the attack infrastructure.
If Shahid Kaveh is interested in Modbus, that is no accident, even if here it is associated with the reconnaissance phase rather than the compromise of the devices. In its TCP version, this industrial protocol includes no authentication: any device reachable on port 502 can read and write its registers for whoever asks. Combined with FOFA, which indexes exposed equipment much like Shodan, the targeting becomes almost industrialized. No zero-day flaw needed!
However, in the fridge attack case, Modbus is used internally, between the supervisor and the controllers. What was exposed on the Internet was the supervisor’s web interface (HTTP/HTTPS). In other words, the attackers did not get in through Modbus. Nor, in principle, through the flaws disclosed by Claroty in the AK-SM 800A: before the Senate on October 21, Vincent Strubel, Director General of ANSSI, ruled out that avenue. According to him, the attackers took advantage of other factors: devices directly exposed to the Internet, poorly secured and protected by weak passwords. Danfoss says that most of the affected devices were older end-of-life models that no longer receive security updates.
Charlie Hebdo and the 2024 Olympics: the Other Unit, Shahid Shoostari
The second part of this report concerns Shahid Shoostari (also known as Emennet Pasargad). The C4 attributes to it the defacement of Charlie Hebdo’s online store and the exfiltration of its database on January 4, 2023, the day the weekly magazine was due to publish the results of a caricature contest about Ali Khamenei.
In a completely different area, another incident is mentioned and is linked to the Paris 2024 Olympic Games. The facts date back to July 20, 2024, when a French company managing video display terminals was compromised by this group. The goal of the attacks was to broadcast photo montages denouncing the participation of Israeli athletes, but the intrusion was discovered beforehand.
In this report, what somewhat surprised me compared with what we usually see is the appendix at the end of the document. Indeed, this appendix contains photos of three alleged leaders, including Hamid Reza Lashgarian, presented as the head of the IRGC-CEC.
Finally, note that this report does not mention the cyberattack targeting the EFS service provider. Same team or just a coincidence? For now, the question remains unanswered.
