The most recent incident, the attack on industrial refrigeration controllers on 11 and 12 October 2026, is described as unprecedented in scale and aggression. It adds to other attacks observed since at least 2020, including operations against Charlie Hebdo in 2023 and against a French video display company during the Paris 2024 Olympic and Paralympic Games.

The October 2026 attack on refrigeration controllers

On 12 October 2026, the C4 was alerted to an attack on the refrigeration controllers of around 700 retail sites across France. The equipment was compromised overnight between Sunday 11 and Monday 12 October. Attackers changed the defrost parameters to high temperatures, causing significant losses of goods and at least 15 fires.

Affected organisations are mainly large retailers, notably the Casino, Leclerc, Coopérative U, Metro, Carrefour and Intermarché groups. The C4 also knows of victims in the agri-food sector, including several small butcher shops, a slaughterhouse and cooperative food-processing plants.

The C4 also observed concurrent targeting of Schneider Electric equipment at small hydroelectric installations in France, which it links to the same attack. Effects on those devices were moderate.

Attribution: IRGC as sponsor, Shahid Kaveh as operator

The C4 cites a body of evidence pointing to the IRGC as the sponsor and Shahid Kaveh as the executing unit:

  • Shared infrastructure: the infrastructure used in the attack was also used during the same period for reconnaissance against Schneider Electric equipment, particularly in small and medium-sized energy and water production facilities. The technique (Modbus protocol on port 502) has been associated with Shahid Kaveh since at least April 2026.
  • Tooling: the operators used the FOFA scanning tool, which is habitually used by this intrusion set.
  • Propaganda amplification: the attack was relayed on CyberbanNews, a propaganda outlet associated with Shahid Kaveh, as early as 13 October 2026.
  • Language artefacts: traces of Farsi were found in the attack infrastructure.

About Shahid Kaveh

According to the C4, Shahid Kaveh is led by Reza Salarvand and Mahdi Lashgarian. It is best known through hacktivist personas, including CyberAveng3rs, Soldiers of Solomon, Mr. Soul and Cyber Isnaad Front, and through its online outlet CyberbanNews. These personas publicly claim some of the unit's attacks.

The unit runs large-scale campaigns against industrial equipment for sabotage purposes. Targets are mainly Israel and the United States, but also France and other European countries. Known activity includes:

  • November 2023: a campaign claimed via CyberAveng3rs against Israeli vendor Unitronics, whose industrial control systems are used in the US and Europe.
  • March and April 2026: a large-scale sabotage campaign against Israeli and American interests, affecting industrial control equipment including Israeli refrigeration systems.
  • Since at least June 2024: the unit has had scripts to scan, access and control industrial control equipment from Schneider Electric, Siemens and Rockwell.
  • April 2026: the unit was seen using Modbus on port 502 for mass reconnaissance of Schneider Electric industrial control systems, notably in France.

The C4 also names Hamid Reza Lashgarian as head of the IRGC-CEC.

Earlier operations by Shahid Shoostari (since 2020)

The C4 attributes several operations against France or French interests since 2020 to the IRGC-CEC through its unit Shahid Shoostari, also documented in open sources as Iliyanet or Emennet Pasargad.

Charlie Hebdo (2020 and 2023)

The C4 confirmed that Emennet Pasargad / Shahid Shoostari targeted Charlie Hebdo in 2020, a plan revealed in 2021 by Lab Dookhtegan, a group presenting itself as a dissident Iranian hacktivist organisation. The operation is assessed as retaliation and intimidation after the weekly republished caricatures of the Prophet in September 2020.

On 4 January 2023, the day Charlie Hebdo was due to publish the results of a caricature contest about Ali Khamenei, then Supreme Leader of Iran, the magazine's online shop was defaced and the information in its database was exfiltrated. Investigators recovered technical elements of the attacking infrastructure and evidence of the attack being exploited through online claims. These were attributed to Shahid Shoostari acting for the IRGC.

Paris 2024 Olympics

From 20 July 2024, a French company operating a video display management system was compromised using an intrusion set operated by Shahid Shoostari. The attackers tried to hijack the display units to show photo-montages denouncing the participation of Israeli athletes. All of the company's customers could have been affected, but the compromise was discovered before the images were displayed.

Investigations that began on 25 July 2024 found:

  • Malicious activity going back several days before discovery.
  • Tools also documented by security vendors and international partners as associated with Emennet Pasargad.
  • Browsing activity on several French media sites ahead of the Games.
  • The photo-montages first appeared on 24 July 2024, one day before discovery, on a Persian-language Instagram account, then spread via two X accounts and the Iranian outlet jahannews[.]com.
  • The attackers used two IP addresses belonging to Iranian ISPs while operating in the victim's network.

Source: CERT-FR / C4, Activités cyber offensives menées par des acteurs iraniens liés au CGRI, CERTFR-2026-CTI-009, 9 November 2026 (TLP:CLEAR). https://cert.cyber.gouv.fr/cti/CERTFR-2026-CTI-009/