CyberAv3ngers: The IRGC Unit Behind France’s Fridge Attacks

WarBrief Live | November 11, 2026 | Cybersecurity

France says the Iranian Revolutionary Guard Corps cyber unit Shahid Kaveh, operating under the name CyberAv3ngers, hacked refrigeration systems at about 700 French supermarkets on October 11-12, 2026, driving temperatures from -16.6°F to above 122°F and starting at least 15 fires.

On November 9, Paris formally blamed Tehran for the attack, named three Iranian officials, opened a criminal investigation and asked for international arrest warrants. It was the first time the French government has directly accused Iran of a cyberattack on its territory. Iran rejected the accusation as “baseless” the following day. This explainer sets out what happened, who CyberAv3ngers are, how the fridges were taken over, and what happens next.

What happened in the French supermarket fridge attacks?

During the night of October 11-12, 2026, hackers took remote control of refrigeration systems at around 700 commercial sites across France. Most were supermarkets, but the victims also included small butcher shops, a slaughterhouse and food-processing plants, according to the French government report on the incident.

The attackers overrode the digital thermostats and switched on abnormal, indefinite defrost cycles. At the same time, they disabled the sensor alerts designed to sound when temperatures rose above a set threshold, the Paris prosecutor said. Temperatures inside the units swung from as low as -16.6°F (-27°C) to above 122°F (50°C), the French report said. Food spoiled on a large scale: staff at one Intermarché in western France were photographed carting boxes of perished meat and melted ice cream into large waste containers the following morning.

The heat was severe enough to start fires. The French report counted at least 15 fires breaking out as the hackers cranked up the heat inside refrigeration units. One French supermarket owner estimated the total cost across the country could reach tens of millions of euros, Reuters reported.

The same hackers also probed controllers at several small French hydroelectric plants, according to the French report, causing moderate disruption there. That detail matters: it suggests the target list went beyond food retail and touched energy infrastructure too.

Who are CyberAv3ngers — and what is Shahid Kaveh?

CyberAv3ngers is the online name of Shahid Kaveh, an offensive cyber unit inside Iran’s Revolutionary Guard Corps (IRGC). France describes Shahid Kaveh as a unit of the IRGC’s Electronic and Cyber Centre (IRGC-CEC), the Guard’s cyber and electronic warfare arm, and says the centre ordered the attack and Shahid Kaveh carried it out.

The name Shahid Kaveh means “Martyr Kaveh” and honours Mahmoud Kaveh, an IRGC commander killed in the Iran-Iraq war in 1986 at the age of 25. Tehran has never publicly acknowledged the unit’s existence. Leaked Iranian documents dating back to 2020, published by Sky News, showed the unit had studied ways to damage civilian infrastructure including cargo shipping, fuel stations and satellite communications at sea.

Shahid Kaveh rarely appears under its real name. According to the French agencies, it works through front groups that present themselves as vigilante hackers and publicly claim its attacks. The personas named in the French report include CyberAveng3rs — the spelling France uses — along with Soldiers of Solomon, Mr. Soul and the Cyber Isnaad Front. CyberbanNews acts as its online communications outlet and publicised the October attack on October 13.

The group first became widely known as CyberAv3ngers in November 2023, after the start of the war in Gaza. Its early operations targeted Israeli-made Unitronics programmable logic controllers (PLCs) — the small industrial computers that run machinery — at water and wastewater facilities in the United States, Israel, the United Kingdom and Ireland. The hackers exploited internet-exposed controllers, many protected by default passwords, and displayed pro-Palestinian messages on their screens.

How did the attackers take over the fridges?

According to the Paris prosecutor, the attackers took control of the refrigeration equipment remotely through its web interfaces. Once inside, they forced the defrost cycles on and switched off the temperature alarms at the same time, so nobody was warned while the food warmed and then overheated.

The intrusions appear to have been simple to carry out. Saher Naumaan, a senior threat researcher at the cybersecurity company Proofpoint, told Reuters the cold-storage sabotage showed less about Iran’s skill than about “how exposed these systems are”. The firm behind many of the affected units said several were obsolete or running outdated firmware, which could have made them easy to break into.

France’s case for blaming Shahid Kaveh rests on four strands of technical evidence set out in a five-page report from the country’s Cyber Crisis Coordination Centre, which brings together the national cybersecurity agency ANSSI, the military cyber command, the DGSE foreign intelligence service and the DGSI domestic security service. The report cites traces of Persian in the attack infrastructure, IP addresses pointing to devices located in Iran, intrusion tooling and infrastructure matching earlier hacks by the unit, and a distinctive technical pattern.

Microsoft had privately linked Iran to the October sabotage at least two weeks before France went public, Reuters reported, citing three people familiar with the matter. The company declined to comment.

Background and timeline: from US water utilities to French freezers

The French fridge attacks are the latest step in a campaign that has run for three years, moving from propaganda-style defacements to physical sabotage of the systems that keep food cold and water flowing.

• 2020: Leaked Iranian documents later published by Sky News show Shahid Kaveh studying vulnerabilities in civilian infrastructure, from cargo ship ballast systems to fuel tanks.
• November 22, 2023: CyberAv3ngers begins breaking into US water and wastewater facilities, compromising dozens of internet-exposed Unitronics controllers and displaying messages supporting Gaza.
• December 1, 2023: The FBI, CISA, NSA, EPA and Israel’s National Cyber Directorate issue a joint advisory identifying CyberAv3ngers as an Iranian government-affiliated cyber persona exploiting Unitronics devices.
• February 2, 2024: The US Treasury sanctions six IRGC-CEC officials for directing CyberAv3ngers operations, including Hamid Reza Lashgarian and Mahdi Lashgarian. The State Department offers up to $10 million for information on the group.
• March 2026: Hackers target the Los Angeles transit system, in a wave of incidents Reuters links to the wider Iran-linked cyber campaign.
• July 2026: US water treatment plants are hit, with more than 30 water systems targeted in Minnesota alone. US agencies note similarities to CyberAv3ngers activity but do not formally name the group.
• August 2026: Refrigerators in at least six US military commissaries — the on-base grocery stores for military personnel and their families — lose refrigeration. Pentagon investigators treat the failures as a suspected cyberattack and view Iran as a suspect. The investigation is still in progress and the attribution is unconfirmed.
• October 11-12, 2026: About 700 French commercial sites are hit in the supermarket fridge attacks.
• November 2, 2026: Grocery stores in at least nine other European countries are hit by a suspected freezer cyberattack. These attacks have NOT been attributed to Iran. A second November wave later hits more than 100 establishments across Europe, including refrigerators used by French blood banks.
• November 9, 2026: France formally attributes the October attacks to Shahid Kaveh at the G7 foreign ministers’ meeting in Paris. Foreign Minister Jean-Noël Barrot says: “I can confirm that this attack was carried out by the Islamic Revolutionary Guard Corps (IRGC) of the Islamic Republic of Iran.”
• November 10, 2026: France summons Iran’s ambassador. Iran’s Foreign Ministry rejects the accusations as “baseless and one-sided”.
• November 16, 2026: The EU Foreign Affairs Council is due to take up the cyber incidents, with France seeking sanctions against those responsible.

By the numbers: what is confirmed and what is only reported

Caveat: figures marked CONFIRMED come from the French government report, the Paris prosecutor or US official sources. Figures marked REPORTED rest on a single estimate or an investigation that is still open, and are labelled as such.

What the fridge attacks mean for US/UK/EU readers

For readers in Europe, the attack is a reminder that the Iran war, which began in February 2026, has reached civilian infrastructure far from any battlefield. Supermarkets are not military targets, and the damage was measured in spoiled food, closed aisles and burnt-out refrigeration units rather than casualties. But the pattern — cheap, remote sabotage of the industrial controllers that run everyday systems — is exactly what security agencies have warned about for years.

For shoppers, the direct impact was short-lived: food was discarded and some stores closed cold aisles while units were repaired. The wider cost may show up in food prices and insurance. One supermarket owner estimated losses in the tens of millions of euros across France, and a second wave of freezer failures in November hit more than 100 establishments across Europe, including blood-bank refrigerators in France, where staff had to move blood to other cold storage.

For the UK, the episode is a warning rather than a confirmed attack. No UK incident has been attributed to Shahid Kaveh in the reporting reviewed for this article, but the November 2 wave hit grocery stores across at least nine European countries, and the UK sent cyber specialists to help allies as the disruption spread. British supermarkets use the same kinds of internet-connected refrigeration controllers, and the same exposure — outdated firmware, default passwords, web interfaces left open to the internet — applies well beyond France.

For US readers, the story connects directly to home: the same group hit American water utilities in 2023, US water treatment plants were attacked again in July 2026, and Pentagon investigators suspect Iranian involvement in the August failures at six military commissaries. The US government already has a $10 million reward out for information on the group’s operators, and the Treasury sanctioned its leadership in 2024.

For businesses that run cold chains, warehouses or any industrial equipment, the lesson is practical rather than political. The attack succeeded not through exotic tradecraft but through exposed, poorly maintained controllers: change default credentials, keep firmware updated, take industrial control systems off the public internet where possible, and make sure temperature alarms cannot be switched off from the same interface that controls the equipment. That advice comes from the security researchers who studied the incident, not from any government.

What France says, and what Iran says

France’s position is categorical. Foreign Minister Jean-Noël Barrot told reporters at the G7 meeting in Paris that the attack was “unprecedented in both its scale and its level of aggression” and “the first large-scale cyberattack aimed at sabotage on our national territory”. Asked on November 10 how France could be certain the IRGC was behind it, Barrot said France had established it “with certainty” but would not disclose how. He added that the Revolutionary Guards would “obviously” deny responsibility because “they fear the response that we could make, and that we will make.”

Barrot also warned that France would “rule nothing out and will take all measures — including those we may not disclose publicly — that we deem proportionate and necessary to deter any further attacks”. France summoned Iran’s ambassador on November 10 and says it will seek sanctions at European level. EU foreign policy chief Kaja Kallas said the bloc’s response “should be strong” and that the Foreign Affairs Council would take up the incidents on November 16.

US Secretary of State Marco Rubio, who attended the Paris talks, backed the French assessment. “It does not surprise us,” he said. “They [Iran] have done things like this for a very long time.” He described the IRGC as a “deranged group of revolutionaries”.

Iran’s position is a flat denial. Its Foreign Ministry said on November 10 that it “categorically rejects the French government’s baseless and one-sided accusations against Iran regarding alleged cyber activities in France”, and condemned what it called a “hackneyed policy of levelling accusations against the Islamic republic”. Foreign Minister Abbas Araghchi blamed the French government for the incident, and Tehran said it “will not hesitate to take necessary and appropriate measures to protect its national interests and security against unlawful foreign actions”. Iran’s mission to the United Nations did not respond to requests for comment, and Iran routinely denies carrying out malicious cyber operations.

The dispute now sits where attribution disputes usually sit: a government assessment built on technical traces that the public cannot inspect, against a denial from the accused state. What is not in dispute is that 700 sites were sabotaged, food was destroyed and fires broke out. The criminal case in Paris — and the EU sanctions decision on November 16 — will test how far the French evidence carries.

What happens next in the CyberAv3ngers case

Three tracks are now running in parallel. The first is legal: the Paris prosecutor’s judicial investigation, with international arrest warrants requested for Lashgarian and his two deputies. Arrest is unlikely — the men are in Iran — but warrants restrict their travel and add to the sanctions already in place since 2024.

The second is diplomatic: the EU Foreign Affairs Council meets on November 16, where France will press for sanctions against those responsible. Barrot has also raised the possibility of undisclosed French responses, including cyber measures of France’s own. The G7 foreign ministers, meeting in Paris, have already condemned Iran’s disruption of shipping through the Strait of Hormuz and expressed solidarity with Saudi Arabia over Houthi attacks, so the fridge case lands in a week of coordinated Western pressure on Tehran.

The third is operational: investigators in France, the US and across Europe are still examining the November wave of freezer failures and the August commissary incidents. If those are linked to the same group, the case for treating Shahid Kaveh as an active, ongoing threat to European civilian infrastructure strengthens considerably. If they are not, the October attack still stands as the first time a state-linked cyber unit has sabotaged food infrastructure on this scale in Europe — and the first time a European government has named the unit responsible in public.

WarBrief will update this article as the November 16 EU meeting and the Paris investigation develop. For the wider cyber picture, see our coverage of the Zyxel zero-day that left 996 switches exposed, the Vanderbilt ransomware attack, and the suspected AI-assisted 3AM ransomware attack on UK schools. For the Iran war context, see how AI is reshaping the conflict in the Middle East and our cyber risk assessment framework for the defence industrial base. All of these stories sit inside our Conflict Zones coverage.

Frequently asked questions

What is CyberAv3ngers?
CyberAv3ngers is the online name of Shahid Kaveh, an offensive cyber unit inside Iran’s Revolutionary Guard Corps. France says the unit sits within the IRGC’s Electronic and Cyber Centre, works through front groups posing as vigilante hackers, and has targeted industrial control systems in the US, Israel and Europe since 2023. Tehran has never publicly acknowledged the unit exists.

How did the hackers take control of the fridges?
According to the Paris prosecutor, the attackers connected remotely to the refrigeration equipment through its web interfaces, forced abnormal defrost cycles and simultaneously disabled the temperature alarms. Security researchers say the attack was relatively simple because many of the controllers were exposed online, obsolete or running outdated firmware.

Has Iran admitted responsibility for the fridge attacks?
No. Iran’s Foreign Ministry called the French accusations “baseless and one-sided” on November 10, and Foreign Minister Abbas Araghchi blamed the French government for the incident. France says it established the IRGC’s responsibility “with certainty” but has not disclosed how it reached that conclusion.

Have similar attacks happened in other countries?
Yes. On November 2, grocery stores in at least nine other European countries were hit by a suspected freezer cyberattack, and a second November wave hit more than 100 establishments including French blood banks — but neither wave has been attributed to Iran. In the US, the same group hit water utilities in 2023, and Pentagon investigators suspect Iranian involvement in refrigeration failures at six military commissaries in August 2026, though that investigation is still open.

What happens next?
The EU Foreign Affairs Council is due to discuss the incidents on November 16, where France will seek sanctions against those responsible. The Paris prosecutor has opened a judicial investigation and requested international arrest warrants for three named Iranians. France has also warned it may take further measures it will not disclose publicly.

Sources

• Channel NewsAsia (AFP): France says Iran behind ‘unprecedented’ cyberattacks on fridges
• Reuters: France summons Iran envoy over supermarket fridge hack, warns of response
• The Straits Times (Reuters): France accuses Iran of supermarket fridge cyberattacks
• CNN: France blames Iran for ‘unprecedented’ supermarket fridge cyberattack
• SOFX: France Blames Iran Revolutionary Guard for Cyberattack Heating 700 Food Freezers
• Le Monde: Why France accused Iran and its Shahid Kaveh cyber unit of being behind freezer hacks
• The Korea Times: Iran rejects France’s ‘baseless accusations’ on cyberattack
• Tenable: CyberAv3ngers — FAQ About Iran-Linked Threat Group Targeting U.S. Critical Infrastructure