France Is Latest Victim of Iranian Cyber Sabotage First Unleashed on Israel

Refrigerators across France have been going haywire.

On November 9, France formally blamed Shahid Kaveh, a unit operating under Iran’s Islamic Revolutionary Guard Corps Cyber Electronic Command (IRGC-CEC), for a hacking operation the previous month that impacted about 700 French supermarkets. Also struck were butcher shops, a slaughterhouse, cooperative food plants, and Schneider Electric equipment at hydroelectric plants. French authorities called it the “first offensive cyber campaign carried out purely for the purposes of sabotage on French soil.”

The attacks bear similarities to cyberattacks on refrigeration equipment in Israel as well as suspected attacks on commissaries at U.S. military bases. In what may be copycat operations or an expansion of Iran’s attacks, hackers have also compromised refrigerators at grocery stores across Europe and industrial cooling equipment at France’s national blood bank.

Until companies protect their internet-connected equipment, and until the hackers and their sponsors are brought to justice, these attacks will likely continue.

Techniques Honed on Israel Have Already Reached U.S. Infrastructure

The hackers’ techniques, as detailed by French authorities, mirror those used against a kosher grocery chain and other facilities in Israel this spring. The chief executive of Israeli cybersecurity company Profero described the French attacks as “built and practiced against Israel.” In October, the hacktivist front group Cyber Isnaad Front claimed responsibility for operations that destroyed refrigerator compressors and wiped corporate computers at a food-processing plant, according to Profero. France has claimed that Shahid Kaveh operates the Cyber Isnaad Front, but FDD analysis links the group more closely to another unit under the IRGC-CEC, Shahid Shushtari. The malware and tooling in the French attacks, however, closely resemble those deployed by CyberAv3ngers, another Iranian hacking front group best known for attacking U.S. water utilities in November 2023 and run by Shahid Kaveh. The shared tooling may indicate collaboration between the two front groups.

Similarly, before CyberAv3ngers compromised Israeli-made Unitronics controllers at small U.S. water utilities in November 2023, hackers compromised other Unitronics devices in distribution centers and irrigation systems in Israel. A U.S. advisory in July 2026 noted that ongoing attacks against U.S. critical infrastructure resembled those of CyberAv3ngers. 

Hackers Work at Direction of the IRGC

Earlier attacks on French targets were pinned on Shahid Shushtari, another cyber outfit under the IRGC-CEC. Led by U.S.-sanctioned IRGC-Quds Force commander Hamid Reza Lashgarian, the IRGC-CEC oversees a web of Iranian hacking groups, including Shahid Kaveh and Shahid Shushtari. Shahid Shushtari faces a $10 million bounty under the State Department’s Rewards for Justice program for its attempts to interfere with the 2020 U.S. presidential election.

The two organizations share personnel and tooling, making distinguishing one from the other difficult. The State Department says that senior IRGC-CEC official Amir Yaryab directs Shahid Shushtari but also controls CyberAv3ngers operations. The U.S. Treasury Department, meanwhile, sanctioned Mohammad Bagher Shirinkar as the head of Shahid Shushtari, but France has described him as a Shahid Kaveh commander.

Allies Should Issue Joint Sanctions and Conduct Cyber Drills

French prosecutors have issued international arrest warrants for members of the IRGC-CEC. The French Foreign Ministry has pledged to impose new sanctions on those involved in the attack. France should exchange target lists with the United States to ensure that the two countries sanction and prosecute everyone involved in operations directed by the IRGC-CEC.

Sanctions, however, will not fix the security failures and weak passwords that Iran’s hackers exploited in the latest attack. The U.S. Cybersecurity and Infrastructure Security Agency issued a warning about the vulnerability in the refrigerators back in February, but companies failed to mitigate the problem. France needs better information and intelligence sharing with Washington as well as Israel on shared threats — which often sees Iranian operations before other partners — to ensure its companies have the latest cyber threat intelligence. The three partners should also conduct tabletop and live-fire cyber exercises modeled on Iran’s attacks against refrigeration and water controllers to test rapid information-sharing and recovery processes and help prevent similar attacks in the future.   

Ari Ben Am is an adjunct fellow at the Center on Cyber and Technology Innovation (CCTI) at the Foundation for Defense of Democracies (FDD), where he focuses on emerging threats, influence and information operations, cyber operations, and hybrid warfare. For more analysis from the author and FDD, please subscribe HERE. Follow FDD on X @FDD and @FDD_CCTI. FDD is a Washington, DC-based, nonpartisan research institute focusing on national security and foreign policy.