France formally attributes the Oct 11-12 sabotage of refrigeration controllers at about 700 supermarkets to Iran's IRGC unit Shahid Kaveh
- Attribution evidence (CERT-FR): the attack infrastructure was also used in the same period for Modbus (TCP 502) reconnaissance of Schneider Electric equipment at small energy and water plants, a technique tied to Shahid Kaveh since at least April 2026; operators used the FOFA scanning service; the IRGC-linked outlet CyberbanNews relayed the attack on Oct 13; and Farsi traces were found on the infrastructure.
- Named leaders: CERT-FR names Reza Salarvand and Mahdi Lashgarian as Shahid Kaveh's commanders and Hamid Reza Lashgarian as head of the IRGC electronic and cyber center.
- Also attributed: the IRGC's Shahid Shoostari unit (Emennet Pasargad) for the January 2023 Charlie Hebdo shop defacement and data theft, and a July 2024 compromise of a video-display operator ahead of the Paris Olympics.
- What to do: internet-exposed building and refrigeration controllers are the target set. See the Nov 5 CISA/FBI cold-chain hardening item and its companion tip for finding exposed controllers.
Sources: France Diplomatie: Déclaration d'attribution à l'Iran de cyberattaques visant la France (Nov 9, 2026) · CERT-FR CERTFR-2026-CTI-009: Activités cyber offensives menées par des acteurs iraniens liés au CGRI (Nov 9, 2026, TLP:CLEAR)