French authorities have formally attributed a series of disruptive cyberattacks against refrigeration systems to the Islamic Revolutionary Guard Corps (IRGC). A report released Monday by the Cyber Crisis Coordination Centre, a joint body comprising France’s national cybersecurity agency ANSSI and various intelligence and military commands, identified the perpetrators as the Shahid Kaveh unit. This group is alleged to have sabotaged cooling equipment at approximately 700 grocery stores across France during October, resulting in significant food spoilage and at least 15 reported fires.
The French government confirmed that the attacks targeted a diverse range of facilities, including large supermarket chains, independent butchers, a slaughterhouse, and food-processing cooperatives. In addition to the refrigeration sabotage, ANSSI reported that the same actors simultaneously targeted Schneider Electric industrial control equipment at several small hydroelectric facilities, though the impact on those sites was characterized as moderate.
French Foreign Minister Jean-Noël Barrot stated that the government has summoned the Iranian ambassador and is actively pursuing European sanctions against the individuals responsible. Concurrently, the Paris Prosecutor’s Office has launched a formal judicial investigation into the leadership of the Shahid Kaveh unit. Prosecutor Laure Beccuau confirmed that international arrest warrants have been requested for the unit’s head, Hamid Reza Lashgarian, as well as two deputies identified as Mahdi Lashgarian and Reza Salarvand.
Investigators linked the activity to the IRGC by uncovering Farsi-language artifacts, specific tooling, and reconnaissance infrastructure consistent with previous operations. The Shahid Kaveh unit is widely recognized by international security agencies, including those in the United States, as being synonymous with the group known as CyberAv3ngers. This entity has previously been implicated in attacks against operational technology and industrial controllers within the U.S. water sector.
While the French report focuses on the October incidents, a second wave of attacks occurred in early November, affecting businesses across 11 European countries. This subsequent wave reportedly impacted meat suppliers in the United Kingdom and three facilities operated by the French national blood service. The French authorities’ report did not explicitly address these later incidents, focusing instead on the initial wave of sabotage.
Beyond the refrigeration attacks, the report detailed a broader pattern of hostility directed at French interests over the past six years. ANSSI attributed several prior incidents to a different IRGC-affiliated unit, Shahid Shoostari, also known as Emennet Pasargad. This unit was linked to the 2020 targeting of the satirical newspaper Charlie Hebdo and a failed attempt to hijack digital advertising displays during the 2024 Paris Olympics to broadcast messages regarding Israeli athletes.
Evidence for the Shahid Shoostari operations included connections to specific Iranian internet service provider IP addresses, as well as activity traced to an Iranian news website and various social media accounts. French officials noted that both the Shahid Kaveh and Shahid Shoostari units operate under the umbrella of the IRGC’s Electronic and Cyber Center, suggesting a coordinated campaign of destabilization.
The Iranian government has not issued a public response to the French allegations. Historically, Iran has consistently denied involvement in malicious cyber activities. The French investigation remains ongoing, with authorities continuing to analyze the infrastructure and methods used in what they described as an unprecedented and aggressive campaign against civilian and industrial targets.
