What Is Shahid Kaveh? Iran Cyber Unit Accused Of Hacking 700 French Supermarkets

France has accused an Iranian cyber unit linked to the Islamic Revolutionary Guard Corps (IRGC) of carrying out a cyberattack that disrupted refrigeration systems at around 700 large retail sites across the country, causing food losses and at least 15 fires. The attack, carried out during the night of October 11-12, 2026, targeted supermarket refrigerators and freezers, remotely altering their settings and raising temperatures.

The French government has identified the unit as Shahid Kaveh, an offensive cyber group affiliated with the IRGC's Electronic and Cyber Center (IRGC-CEC). The French assessment places the unit within Iran's military-linked cyber apparatus and identifies it as the group that carried out the October attack. Its previous operations have included targeting industrial control systems used in water and energy infrastructure in the United States and Israel.

What Is Shahid Kaveh And How Is It Linked To Iran's IRGC?

Shahid Kaveh is one of the IRGC's offensive cyber units, operating within its Electronic and Cyber Center. The centre is responsible for cyber operations on behalf of Iran's Revolutionary Guards, while Shahid Kaveh has focused on campaigns targeting industrial control systems.

The name appears to refer to Mahmoud Kaveh, an IRGC commander who died during the Iran-Iraq War in the 1980s. The Persian word 'Shahid' translates to 'martyr'.

According to the French intelligence assessment, Shahid Kaveh is known through several online hacktivist identities, including CyberAveng3rs, Soldiers of Solomon, Mr. Soul and Cyber Isnaad Front. These identities are used to publicly claim responsibility for some of the unit's operations. The assessment also identifies CyberbanNews as the unit's online communications outlet, which publicised the October attack on October 13.

France has identified three individuals linked to the unit. Hamid Reza Lashgarian, head of the IRGC-CEC and a commander in the Quds Force, is the senior figure in Iran's cyber apparatus named in the assessment. Reza Salarvand and Mahdi Lashgarian are identified as the leaders of Shahid Kaveh. According to cybersecurity firm DomainTools, Salarvand was responsible for selecting targets, supervising cyber intrusion campaigns and aligning the unit's activities with the IRGC's strategic objectives. According to Le Monde, the Paris prosecutor's office has sought international arrest warrants against all three individuals.

From US Water Systems To Attacks On Industrial Infrastructure

Shahid Kaveh's activities predate the French supermarket attacks. According to Le Monde, leaked Iranian documents dating back to 2020, published by Sky News, showed that the unit had examined ways to cause damage to commercial shipping, petrol stations and satellite communications at sea. France, the United States, the United Kingdom and Israel were among the countries identified as potential targets. The documents indicate an interest in disrupting infrastructure, although they do not establish that all the proposed operations were carried out.

The group came to prominence in November 2023, when it began claiming responsibility for cyberattacks under the name CyberAveng3rs. One of its prominent operations targeted Unitronics programmable logic controllers (PLCs) used by water and wastewater facilities in the United States.

The hackers accessed internet-exposed controllers, many protected by default passwords, and displayed messages supporting Palestine on their screens. These controllers are used to monitor and manage physical processes. Although the incident raised concerns about the security of critical infrastructure, it did not cause significant damage, according to Le Monde.

The US Cybersecurity and Infrastructure Security Agency (CISA), alongside other federal agencies, subsequently warned about Iranian government-affiliated actors targeting industrial control equipment. Its December 2023 advisory specifically identified CyberAv3ngers as an Iranian government-affiliated cyber persona exploiting Unitronics devices.

The group's activities were not limited to water infrastructure. Le Monde reported that Shahid Kaveh was also linked to attacks targeting refrigeration systems in Israel in March and April 2026, before the operation in France.

The group's earlier operations were often accompanied by propaganda claims that exaggerated the scale of attacks or, in some cases, took credit for actions that had not taken place. A Google assessment cited by Le Monde in February 2024 said the group's claims were intended to shape the information environment and create a perception of weakness in Israeli defences, rather than necessarily achieve tangible physical effects. This assessment concerned the group's earlier operations, not the October 2026 attack in France.

Shahid Kaveh is not the only Iranian cyber unit accused of targeting French interests. France has attributed the 2023 cyberattack against Charlie Hebdo and a 2024 operation targeting a French company that managed video-display terminals during the Paris Olympics to Shahid Shoostari, a separate IRGC cyber unit. The attackers attempted to use the compromised system to display images criticising the participation of Israeli athletes, but the intrusion was detected before the images appeared on the screens.

How France Linked Shahid Kaveh To The Refrigerator Attacks

The attack that brought Shahid Kaveh into the spotlight took place during the night of October 11-12, 2026. Hackers compromised remote-control systems used to manage commercial refrigeration equipment and manipulated the defrost settings, forcing units into abnormal cycles and raising temperatures. Automated alerts designed to warn operators about temperature changes were also disabled, making the disruption harder to detect.

According to the C4 assessment, around 700 large retail sites were targeted, alongside other food-sector businesses, including small butcher shops, a slaughterhouse and cooperative food-processing plants. The attack caused significant merchandise losses and at least 15 fires. The French Foreign Ministry estimated that the spoiled food was worth tens of millions of euros.

The same campaign also targeted Schneider Electric equipment at several small hydroelectric installations in France, although the effects on the equipment were described as moderate.

In a five-page technical assessment, France's Cyber Crisis Coordination Centre (C4) attributed the campaign to Shahid Kaveh. The interministerial body brings together the National Cybersecurity Agency (ANSSI), the Cyber Defence Command (COMCYBER), the Directorate-General of Armament (DGA), the Directorate-General for External Security (DGSE) and the Directorate-General for Internal Security (DGSI). The assessment cited several indicators: infrastructure used in the attack had also been used to scan Schneider Electric equipment; the attackers used the FOFA scanning tool, which the assessment associates with the unit; the attack was publicised through CyberbanNews; and investigators found traces of Farsi in the attack infrastructure.

Some of the refrigeration equipment involved in the attacks was obsolete or running outdated firmware, potentially making it easier to compromise. Danfoss, the Danish manufacturer whose refrigeration systems were affected, said many of the units had reached the end of their service life and no longer received software or security updates. The company had recommended that customers update supported systems and migrate obsolete equipment to newer solutions.

French Foreign Minister Jean-Noël Barrot described the attack as "unprecedented in both its scale and its level of aggression". The announcement marked the first time France had directly accused Tehran of a cyberattack and publicly identified the military-linked entities it held responsible.

Paris summoned Iran's ambassador and said it would pursue European Union sanctions against those responsible. Iran, however, rejected the allegations. Its Foreign Ministry described France's accusations as "baseless and one-sided", denying Tehran's involvement in the attacks.

A separate wave of refrigeration-related cyberattacks was reported across Europe on November 1–2, affecting more than 100 retail establishments. Pro-Russian groups NoName057(16) and Z-Pentest subsequently claimed responsibility for some of the attacks, although their claims have not been independently verified. Separately, a cyberattack on refrigeration equipment at three regional facilities of the French Blood Establishment (EFS) affected the storage of blood products and plasma. Staff transferred or secured the stored products before any were damaged. The incident did not affect blood supplies, and authorities have not established a connection between these incidents and Shahid Kaveh.