An October cyberattack on refrigeration controllers at about 700 French retail sites was carried out by a cyber unit of Iran’s Islamic Revolutionary Guard Corps (IRGC), the French government said yesterday.
The attackers broke into controllers on the night of October 11 and changed their defrost settings to high temperatures. That caused food losses and, in at least 15 cases, fires.
The unit is called Shahid Kaveh. It is known mainly through hacktivist personas, such as CyberAveng3rs and Cyber Isnaad Front, that publicly claim some of its attacks, France says.
France’s Foreign Ministry plans to summon Iran’s ambassador and to ask its European partners to adopt new sanctions against Iranian organizations and individuals involved in the attack.
The Paris prosecutor’s office opened a judicial investigation yesterday against the unit’s head, the head’s two deputies and anyone else identified. It has asked for international arrest warrants. The offenses under investigation include illegally interfering with computer systems and causing damage by means dangerous to people, both made more serious by the aim of serving a foreign power, Iran.
In the October attack, the attackers took remote control of Danfoss and Dixell refrigeration controllers through web interfaces, the prosecutor’s office said in a press release. They started abnormal defrost cycles with no time limit and switched off the temperature probes’ safety alerts, which should go off above a certain temperature. The attack caused about 20 fires.
Most of the organizations hit were large retailers, according to a joint report by France’s cyber crisis coordination center, known as C4. They include Casino, Leclerc, Coopérative U, Metro, Carrefour and Intermarché.
Small butcher shops, a slaughterhouse and cooperative food plants were also among the victims.
The center also tied the attack to the simultaneous targeting of Schneider Electric equipment at several small hydroelectric installations in France. The effects on that equipment were moderate.
In its attribution statement, the ministry estimated the food losses at several tens of millions of euros and called the operation the first offensive cyber campaign on French soil carried out purely for sabotage.
How France Tied the Attack to Iran
The C4 brings together France’s national cybersecurity agency (ANSSI), the DGSE and DGSI security services, the armament directorate and the cyber defense command. It says four indicators point to the IRGC as the sponsor of the attack and to Shahid Kaveh as the unit that carried it out.
The infrastructure used in the attack was also used during the same period for reconnaissance of Schneider Electric equipment. That equipment is installed at sites such as small- and medium-sized energy and water production sites. The reconnaissance relied on techniques that Shahid Kaveh has used since at least April.
The attackers also used FOFA, a scanning tool they usually use. CyberbanNews, a propaganda outlet linked to the unit, reported on the attack as early as October 13. The attack infrastructure also held traces of Persian.
Prosecutors said the criminal investigation, run by France’s anti-cybercrime office (OFAC) and the DGSI, found an attack method typical of the unit. It also found the use of Persian and IP addresses leading to devices located in Iran.
Shahid Kaveh has previously claimed attacks on industrial equipment, according to C4. Through CyberAveng3rs, it claimed an earlier campaign against Unitronics, an Israeli company that makes industrial control systems, in November 2023. In March and April, it claimed a large sabotage campaign against Israeli and U.S. interests that hit industrial control equipment, including Israeli refrigeration equipment.
France’s attribution does not mention the new wave of refrigeration attacks that struck supermarkets in several other European countries last week.
What Operators Should Do
France’s CERT-FR said in an incident alert that it was aware of numerous compromises affecting remote refrigeration controllers across four product families. They are the Danfoss AK-SM and AK-SC series, the Copeland xweb, and the Dixell xweb.
The alert, last updated on October 16, warned that attack campaigns against this equipment were probably still underway, and that exposing a management interface to the internet goes against good practice.
For controllers that are not compromised, the alert’s steps are:
- Remove internet exposure from these units and from any unit reachable at a public IP address.
- Check insurance contract terms before cutting off the data feed to the refrigeration contractor.
- Review the full configuration, especially the defrost ranges.
- Restore access only through a secure VPN or a protected network. In an emergency, filtering the contractors’ IP addresses at a firewall is possible, but it is not a lasting fix.
- Follow the maker’s recommended practices. For Danfoss devices, this includes updating firmware, setting the security level to Strict, and ensuring default passwords have been changed.
For compromised controllers, the steps are:
- Remove internet exposure and check insurance terms, as above.
- Restart Danfoss equipment, or otherwise restore the device to its factory settings.
- Restore access only through a secure VPN or a protected network. As above, firewall filtering of contractors’ IP addresses is an emergency option, not a lasting fix.
- Reconfigure the device before putting it back into service, then follow the maker’s recommended practices.
An end-of-life (EOL) device that receives no security fixes faces a very high risk of compromise if it remains exposed to the internet, the alert warns. In that case, a factory reset alone is not enough: it removes the attackers’ persistence, but the device stays vulnerable and will almost certainly be compromised again.
