Iranian cyber unit blamed for attacks on European refrigeration systems

French authorities have attributed the October 2026 refrigeration attacks to Shahid Kaveh, an offensive cyber unit within Iran’s Islamic Revolutionary Guard Corps (IRGC), a finding published in CERTFR-2026-CTI-009 and supported by interagency analysis from France’s Cyber Crisis Coordination Centre (C4).

The incidents, which began with around 700 French supermarket refrigerations being manipulated on the nights of 11–12 October and extending into early November across several European states, involved unauthorized changes to defrost cycles and temperature controls. Independent forensic evidence remains limited, and while Iranian-linked indicators are cited, the attribution is described as a convergence of technical and intelligence indicators rather than a single reproducible artifact. French researchers also linked concurrent targeting of Schneider Electric equipment to Shahid Kaveh, complicating the attribution picture.

Independent researchers note that publicly exposed refrigeration controllers—such as Danfoss AK-SM and Copeland/Dixell XWEB platforms—were reachable online, with default credentials and insecure configurations allowing management access.

CVEs documented by Claroty Team82 for Danfoss AK-SM 800A include CVE-2025-41450 (authentication bypass), CVE-2025-41451 (authenticated OS command injection), and CVE-2025-41452 (web-server configuration manipulation), along with earlier CVEs CVE-2023-25913, CVE-2023-25914, and CVE-2023-25915. The report notes that several vulnerabilities remain relevant to exposure management for end-of-life equipment.

Defensive guidance published alongside the report emphasises internet-exposure assessments, restricting remote access, removing default credentials, applying firmware updates, timing and integrity monitoring, independent temperature monitoring, and preserving forensic evidence. No confirmed attacker-controlled IPs or malware hashes have been publicly identified for the campaign.