Iranian hacking groups coordinated a wave of cyber-attacks targeting refrigeration control systems at 700 supermarket locations across France in October, according to French authorities. Paris Public Prosecutor Laure Beccuau announced on social media that investigators found connections between the October 11-12 attacks and Shahid Kaveh and Shahid Shoostari, two elite offensive cyber units affiliated with Iran's Islamic Revolutionary Guard Corps (IRGC). The French government called the incident "an unprecedented campaign in terms of its scale and level of aggressiveness," representing the first cyber-offensive operation conducted purely for sabotage purposes on French national territory.
Investigators from France's Anti-Criminality Office and domestic intelligence service uncovered IP addresses linked to Iran-based endpoints and detected Farsi words in the digital traces left behind by the attackers. The techniques, tactics, and procedures used in the assault matched those employed in previous Shahid Kaveh campaigns, according to a technical attribution notice published November 9 by the French Computer Emergency and Response Team (CERT-FR). That notice also revealed that Shahid Kaveh maintains ties to several purported hacktivist groups, including CyberAveng3rs, Soldiers of Solomon, Mr. Soul, and Cyber Isnaad Front. CERT-FR identified three leaders of the IRGC and Shahid Kaveh connected to the cyber-attacks, and the Paris prosecutor's office has opened a judicial investigation into the attacks and resulting damage.
France's response will include a series of diplomatic and punitive actions, according to a government statement issued November 9. Paris plans to summon Iran's Ambassador to France to formally deliver its strongest condemnation of the attacks. The French government also said it will push European partners to impose additional sanctions targeting Iranian individuals and entities allegedly involved in the cyber-attacks against France and other malicious cyber activities. Gary Barlet, public sector CTO at Illumio, said he is "impressed" that France is planning to pursue sanctions at a European level, adding that "too often an attack gets publicly called out, there's outrage, and then nothing happens."
Historically, France has rarely attributed cyber-attacks to a single country, making this attribution particularly significant. The French government stressed that it reserves the right to take further measures—both public and undisclosed—should they be deemed necessary and proportionate to respond to the cyber threats. CERT-FR's technical notice noted that this attack adds to a series of other incidents attributed to IRGC-linked groups since at least 2020, including destabilization campaigns targeting satirical newspaper Charlie Hebdo in 2023 and a French digital display company in 2024 in the context of the Paris 2024 Olympic and Paralympic Games. The attribution does not include the cyber-attack on the French Blood Service that occurred in early November.
The willingness to publicly name state sponsors and pursue multilateral sanctions may signal a shift in how European nations respond to infrastructure sabotage. If allies prove reluctant to impose costs, attribution alone becomes a symbolic gesture that fails to alter adversary calculations.