France formally attributed the October attacks on supermarket refrigeration systems to Iran’s Islamic Revolutionary Guard Corps, naming the Shahid Kaveh unit, on Monday, November 9. The government said it will summon Iran’s ambassador and propose new European Union sanctions.
C4 Attribution Names the Shahid Kaveh Unit and CyberAv3ngers Persona
The attribution came from France’s Cyber Crisis Coordination Centre, known as C4, which brings together the national cybersecurity agency ANSSI, the military cyber command and intelligence services. It identified the IRGC’s Shahid Kaveh unit, which operates under the “CyberAv3ngers” persona. Reza Salarvand and Mahdi Lashgarian have been named as the unit’s leaders.
Evidence Cited: Reconnaissance Since June 2024 and Farsi Traces
France pointed to four lines of evidence. The attacks shared infrastructure with earlier reconnaissance against Schneider Electric equipment dating to June 2024. Investigators found Farsi traces, and the techniques matched activity since April 2026. An Iran-linked outlet also covered the attacks rapidly.
About 700 Stores Targeted, With At Least 15 Fires
The attacks, carried out on October 11 and 12, targeted about 700 stores, well above the 250 to 350 stores initial reports suggested. At least 15 fires resulted and food losses reached tens of millions of euros. The attackers pushed defrost settings up to about 50 degrees Celsius, which spoiled stock and created fire risk.
Six Grocery Chains and Schneider Electric Hydro Equipment
Six French grocery chains were affected: Casino, Leclerc, Cooperative U, Metro, Carrefour and Intermarche. Schneider Electric equipment at small hydropower sites was also involved.
Ambassador Summons and EU Sanctions Proposal Follow Attribution
France will summon Iran’s ambassador and propose new EU sanctions. This coverage concerns the formal attribution and diplomatic response only; earlier reporting covered the CISA and FBI warning about refrigeration attacks.
Formal Attribution Marks a Step Up in Iran-Europe Cyber Tension
Government attribution by a European state of attacks that physically damaged commercial property marks an escalation in tension between Iran and Europe. The consequences described go beyond data loss: spoiled food and at least 15 fires put the event in the category of attacks on operational technology with direct physical effects.
The attribution also links the grocery attacks to prior activity against Schneider Electric equipment, which indicates that France sees the October attacks as part of a longer campaign. That reconnaissance began in June 2024, well over a year before the refrigeration incidents, and the matching techniques since April 2026 show continuing activity.
The reporting does not describe how the attackers reached the refrigeration controls, or how France obtained the Farsi traces and infrastructure links it cites. Whether the EU adopts the proposed sanctions will depend on decisions by member states, and no timeline has been given. Iran’s response to the attribution has not been reported.
Timeline From Reconnaissance to Attribution
The dates show a long run-up. Schneider Electric reconnaissance linked to the same infrastructure dates to June 2024, matching techniques appear from April 2026, the refrigeration attacks took place on October 11 and 12, and France announced attribution on November 9, about four weeks after the attacks. The tally of stores also grew over time, from initial estimates of 250 to 350 to the roughly 700 France now cites, so the formal attribution comes with a materially larger damage figure than first reports gave.
The naming of Reza Salarvand and Mahdi Lashgarian as leaders of the unit adds individuals to an attribution that otherwise rests on organizational findings from C4. France’s list of evidence does not include a technical indicator tied to the grocery systems themselves, and the government has not published the underlying forensic material. The diplomatic steps it announced, the ambassador summons and the sanctions proposal, are the concrete consequences confirmed so far.
