France Attributes Supermarket Cyberattacks to Iran-Linked Unit
Summary
France attributed October attacks on supermarket refrigeration systems and small hydroelectric equipment to an IRGC-linked unit. C4 cited reconnaissance, shared infrastructure and other technical evidence; French authorities are investigating.
Key points
- France attributed the attacks to Shahid Kaveh, also known as CyberAveng3rs, which it said is affiliated with Iran’s Islamic Revolutionary Guard Corps.
- C4 said attackers targeted controllers in about 700 large supermarkets; refrigeration failures spoiled food, and the agency reported at least 15 fires.
- C4 also linked the campaign to attacks on Schneider Electric equipment at small hydroelectric installations, with moderate effects.
- Evidence cited by C4 included Modbus reconnaissance on port 502, shared infrastructure, use of the FOFA scanning tool and traces of Farsi.
- C4 said the group’s activity was publicized on CyberbanNews. The Paris prosecutor is investigating and has requested international arrest warrants for several alleged members.
- Separate attempted sabotage of French blood-bank cooling facilities and similar incidents elsewhere in Europe were not attributed.
Article Details
- Event Type
- France publicly attributed destructive cyberattacks on supermarket refrigeration systems and hydroelectric equipment to the Shahid Kaveh cyber-offensive unit, which it said is affiliated with the Islamic Revolutionary Guard Corps.
- Impact
- The attacks targeted approximately 700 large supermarkets, caused at least 15 fires, and spoiled millions of euros’ worth of food. C4 reported moderate effects on Schneider Electric equipment at small hydroelectric installations. The French government described the campaign as unprecedented in scale and impact; attribution is the French government’s assessment.
MITRE ATT&CK
People
Hamid Reza LashgarianIdentified by the C4 report as head of the IRGC’s cyber command.Jean-Noël BarrotFrench Foreign Minister who described the attacks as a large-scale act of sabotage and a major attack on France’s interests and security.Kaja KallasEU foreign affairs chief who said European foreign ministers would discuss France’s attribution and a possible response.Lukasz OlejnikPolish cyberwarfare expert who commented on France’s public attribution and the significance of the reported sabotage.Mahdi LashgarianIdentified by the C4 report as a commander of the Shahid Kaveh unit.Marco RubioU.S. Secretary of State who responded publicly to France’s attribution of the attacks.Reza SalarvandIdentified by the C4 report as a commander of the Shahid Kaveh unit.
Threat Actors
CyberAveng3rsThe article identifies CyberAveng3rs as another name for Shahid Kaveh. C4 attributed the supermarket and related attacks to the unit.Islamic Revolutionary Guard Corps (IRGC)The French government said Shahid Kaveh is affiliated with the IRGC’s electronic and cyber center; the reported attribution is to the unit, not directly to the IRGC as the operator.Shahid KavehThe French government, citing the C4 investigation, attributed the supermarket and related attacks to this cyber-offensive unit, which it said is affiliated with the IRGC’s electronic and cyber center.
Vendors
Schneider Electricalso said it had "observed the concomitant targeting, which it links to the same attack, of several Schneider Electric pieces of equipment belonging to small hydroelectric installations in France, with moderate effectsUnitronicsCISA and several international counterparts reported in late 2023 that CyberAveng3rs had targeted and compromised PLCs made by Israeli company Unitronics used in water systems and other sectors in the U.S. and elsewhere.
Tools
Countries
FranceFrance has formally blamed Iran for cyberattacks on refrigeration units in French supermarkets last month and for the simultaneous targeting of hydroelectric plants. The government called it "an unprecedented attackIranFrance has formally blamed Iran for cyberattacks on refrigeration units in French supermarkets last month and for the simultaneous targeting of hydroelectric plants. The government called it "an unprecedented attack
Industries
Energyusing the same technique conducted reconnaissance on Schneider Electric equipment at small and midsized energy and water production facilities. The attackers used the same infrastructure to target the supermarketFood processingleast 15 fires. Other victims included several small butcher shops, a slaughterhouse and cooperative food processing plants. C4 also said it had "observed the concomitant targeting, which it links to the same attack,HealthcareJust last week, CISA issued an alert to the U.S. healthcare sector, warning providers to urgently strengthen protections for internet-connected refrigeration systems used to preserve blood supplies and medication.watersame technique conducted reconnaissance on Schneider Electric equipment at small and midsized energy and water production facilities. The attackers used the same infrastructure to target the supermarket cooling units.