France points the finger at Iran over fridge attacks. Were the Russians lying?

France blames Iran's Revolutionary Guard for supermarket refrigerator cyberattacks and calls for sanctions, while Russian hackers took the blame last week.

France has formally blamed Iran's Islamic Revolutionary Guard Corps (IRGC) for a cyberattack that disrupted refrigeration systems at approximately 700 grocery stores across the country, causing food losses and around 20 fires.

On November 9th, the Paris prosecutor's office announced a judicial investigation into the suspected involvement of an Iranian offensive cyber unit called Shahid Kaveh. The investigation targets the unit's leader, two deputies, and other individuals who may be identified.

“This is an attack of unprecedented scale and unprecedented aggression,” French Foreign Minister Jean-Noël Barrot denounced.

Barrot directly attributed responsibility to the IRGC and announced plans to pursue European Union sanctions against those involved.

“We will take sanctions at the European level against all those responsible for this attack,” the minister stated.

Reportedly, the minister summoned the Iranian ambassador to France on Monday to protest “very strongly against this extremely serious act.”

France identifies three Iranians behind refrigerator attacks

French investigators have identified three Iranian nationals suspected of directing the operation through the IRGC's Electronic and Cyber Center.

According to the French cybersecurity agency's investigation, Shahid Kaveh is led by Reza Salarvand and Mahdi Lashgarian. The wider cyber center is headed by Hamid Reza Lashgarian, who is also identified in reports on the investigation.

The French authorities linked the attacks to Shahid Kaveh through traces of Farsi, IP addresses linked to Iran, and attack infrastructure previously associated with the unit.

Investigators also found that the attack was promoted through CyberbanNews, an online propaganda outlet associated with Shahid Kaveh, shortly after the October incident. The unit operates under several online identities, including CyberAveng3rs and Soldiers of Solomon.

The Paris prosecutor's office has requested international arrest warrants as part of the judicial investigation.

Did the Russians lie about hacking the fridges?

According to The Wall Street Journal, US officials confirmed that probes into the campaign show the hallmarks of Iranian cyber tactics, although the investigation remains ongoing.

According to Reuters, Microsoft had privately linked Iran to the October attacks at least two weeks ago, according to three people familiar with the matter.

The New York Times journalist Dustin Volz posted on X on November 9th, citing three sources, that US intelligence agencies held a “low confidence” assessment that Iran was responsible for the French refrigeration attacks.

“Unlike France, the US does not pin blame on a specific group. US sees Iran as leading suspect on attacks across Europe too,” Volz wrote.

The attribution of the attack has been troublesome. Last week, Russian hacktivists NoName057(16) and Z-Pentest claimed responsibility for attacks on refrigeration systems across Europe.

Security researchers immediately raised red flags, doubting the credibility of the groups' claims.

A threat intelligence researcher using the moniker CyberKnow on X expressed doubts over whether the hacktivists had actually breached the systems or simply claimed credit after media speculation surfaced.

Another security researcher, Oleg Shakirov, noted that the group's previous attacks operated on a much smaller scale, raising doubts about their ability to breach refrigeration systems to such an extent.

After allegations of Russia-aligned groups' involvement became public and Belgian prosecutors opened a formal investigation, the Kremlin dismissed the claims as “absurd.”

Was Iran also behind fridge attacks in Europe?

Following breaches in France, cyberattacks targeting refrigeration systems rippled across Europe.

At the beginning of November, grocery stores in Belgium, Estonia, Ireland, Luxembourg, the Netherlands, Denmark, Sweden, and Finland were forced to discard tons of spoiled food after similar attacks disrupted their refrigeration systems.

Additionally, attackers last week cranked France’s blood storage temperatures to 110°C, threatening critical blood supplies.

“We are not commenting at this stage on the attack that targeted the EFS,” said Vincent Strubel, Director General of the National Cybersecurity Agency of France (ANSSI).

“Even if the modus operandi is similar, nothing at this stage confirms that it is the same attacker,” he explained on LinkedIn.

The attacks in other European countries remain unattributed.

The FBI's cybercrime branch and CISA stated in a joint release that they were “observing malicious cyber activity targeting industrial refrigeration and cold-chain monitoring systems around the world.”

The agencies noted that “security weaknesses in unpatched or internet-accessible controllers can allow attackers to change system settings, potentially causing inventory loss and equipment damage.”