Avengers Disassembled: France Unmasks the Fridge Crew
France named the IRGC unit behind the October attack on fridges at about 700 French sites, and pulled the hacktivist mask off in public.
Hello there cyber fanatics!
Remember the fridges? On the night of October 11th, 2026, someone got into the refrigeration controllers at about 700 sites across France and slowly cooked them. Supermarkets, small butcher shops, a slaughterhouse, food co-ops. Stores threw away their fresh and frozen stock, at least 15 fires started, and the French government puts the food losses at several tens of millions of euros.
For four weeks the big question was who did it. On Monday, November 9th, France answered, loudly.
France’s Cyber Crisis Coordination Centre (C4), which puts the national cyber agency ANSSI, the military cyber command, the armament agency and both intelligence services in one room, published a report that pins the attack on Shahid Kaveh, an offensive cyber unit of Iran’s Islamic Revolutionary Guard Corps (IRGC). An annex names and shows the faces of three men: Hamid Reza Lashgarian, head of the IRGC’s Electronic and Cyber Center (IRGC-CEC), and Mahdi Lashgarian and Reza Salarvand, named as commanders of Shahid Kaveh. The Paris prosecutor opened a judicial investigation and asked for international arrest warrants. The foreign minister summoned Iran’s ambassador and says France will push for EU sanctions. Iran’s foreign ministry called the whole thing “baseless and one-sided.”
The part I care about most is the costume. This unit has worked for years under “hacktivist” brand names, and France just pulled the mask off in public. In my world we say the persona is burned.
Who Turned Up The Heat?
First, what actually happened to the fridges. According to the Paris prosecutor, the attackers took remote control of Danfoss and Dixell refrigeration controllers through their web interfaces. They started defrost cycles with no time limit, and they switched off the alarms that are supposed to go off when the temperature climbs. In plain words: a commercial freezer heats itself for a few minutes every so often to melt the ice. They told it to never stop, and then they made sure nobody got a phone call about it.
The same crew was also poking at Schneider Electric equipment at several small hydroelectric sites in France. France says the effects there were “moderate.”
How did France tie it to Iran? The report lists four indicators:
- The attack infrastructure was used in the same period to scout Schneider Electric gear at small energy and water sites, with techniques Shahid Kaveh has used since at least April.
- The attackers used FOFA, an internet-scanning search engine this unit likes.
- Traces of Persian were left on the attack infrastructure.
- CyberbanNews, a propaganda outlet linked to the unit, was reporting on the attack as early as October 13th.
The criminal investigation adds IP addresses leading to devices in Iran.
Number four made me laugh a little. Remember how the big mystery in October was that nobody claimed it? It turns out the house newspaper of the people who did it was already covering the story the next morning. So it was claimed, kind of, just in the third person.
Hacktivists With a Pension Plan?
France says Shahid Kaveh is known mainly through hacktivist personas that publicly claim some of its attacks: CyberAv3ngers (France spells it CyberAveng3rs), Cyber Isnaad Front, Soldiers of Solomon and Mr. Soul. US agencies already said earlier this year that Shahid Kaveh is another name for CyberAv3ngers, the crew that hit Israeli-made Unitronics controllers at US water utilities in November 2023.
Now put on the business glasses for a second. The IRGC-CEC looks a lot like a holding company. In this one report you can see two divisions. Shahid Kaveh does industrial sabotage. Shahid Shoostari (also known as Emennet Pasargad) does influence and embarrassment: France blames it for the Charlie Hebdo attack in 2023 and for trying to hijack digital display screens around the Paris 2024 Olympics. Each division runs several consumer brands, and the group has an in-house media outlet to cover its own product launches. Basically a conglomerate with a marketing department.
And if you take the personas at their word, the story goes like this: we are independent hacktivists who just really care about fridges, and we happen to share servers with an IRGC unit, and we leave notes in Persian, and our IP addresses go home to Iran, and our favorite news site belongs to the same unit, and two of our “volunteers” have been on a US sanctions list since 2024. Totally grassroots.
That last part is real. Hamid Reza Lashgarian and Mahdi Lashgarian were both sanctioned by the US Treasury in February 2024 over the Unitronics attacks. Reza Salarvand had not been publicly named before. So the “angry activists” have managers, and the managers already had their own sanctions entries.
Real hacktivist crews are messy. They argue, they brag too early, they leak their own screenshots. When a ‘collective’ posts like it has a content calendar, somebody is usually getting paid for it.
Why do states bother with the costume? Because it is cheap and it buys a denial. The persona does the bragging, the government does the denying, and everyone in the middle argues about attribution for a month. Iran’s statement this week is the denial part working exactly as designed.
Have We Seen This Before?
YES! we did!
In September 2012 a group calling itself the Izz ad-Din al-Qassam Cyber Fighters announced “Operation Ababil” on Pastebin and spent months knocking US bank websites offline, as angry activists protesting a YouTube video. In March 2016 the US Justice Department charged seven Iranians over that campaign. They worked for two companies doing work for the IRGC. One of them was also accused of getting into the control system of the Bowman Avenue Dam, a small flood-control dam about 20 miles north of New York City. He could see the water level and the status of the sluice gate. The gate happened to be disconnected for maintenance, which was lucky.
So in 2012 it was a hacktivist mask, bank websites and a tiny dam. In 2026 it is a hacktivist mask, supermarket fridges and small hydro plants. Fourteen years later the playbook barely changed, they just moved from flood gates to frozen peas.
Case Closed?
France’s report covers October only. The second wave, on the night of November 1st into the 2nd, hit stores in at least nine other European countries and three sites of France’s national blood service. Nobody has attributed it yet. Same crew, copycats, or someone who read the news? I don’t know, and I would rather say that than guess.
What do sanctions and arrest warrants actually do here? I don’t expect any of these three men to land at Charles de Gaulle soon. The real damage is to the brand. Every report from now on that mentions CyberAv3ngers has to say “IRGC” in the same sentence, and that makes the costume much less useful.
My prediction: the unit will be back with a new name and a new logo, probably before the EU sanctions paperwork is done, unfortunately.
Before You Go
If you run a store, a restaurant or a small plant, or you know someone who does, check one thing this week: does your fridge controller have a web page that anyone on the internet can reach? France’s CERT-FR advice is simple. Take it off the internet, check the defrost settings, allow remote access only through a VPN, update the firmware and change the default passwords. If the box is end-of-life, a factory reset will not save it, so replace it.
I hope I was able to improve 0.1% of your knowledge. Stay cool out there! and good luck!
Sources
- CERT-FR attribution notice CERTFR-2026-CTI-009 (French)
- The Hacker News: France blames Iran for sabotage attack
- Infosecurity Magazine: France blames Iran for supermarket fridge hack
- DW: Iran denies role in French fridge cyberattack
- US Treasury: sanctions on IRGC-CEC officials, February 2024
- PBS / AP: banks and dam targeted by Iranian hackers, 7 charged