The recent surge in cyber-attacks aimed at refrigeration control systems across 700 supermarket locations in France has been linked to Iranian hacking groups, as confirmed by French authorities. The organized nature of these attacks suggests a methodical approach, raising alarms about the vulnerability of critical infrastructure in the nation.
Laure Beccuau, the Paris Public Prosecutor, took to social media to disclose findings from ongoing investigations, specifically highlighting the connection between incidents that occurred between October 11 and 12. According to Beccuau, these breaches have been tied to two elite cyber units associated with Iran’s Islamic Revolutionary Guard Corps (IRGC): the Shahid Kaveh and Shahid Shoostari groups. Such affiliations add a layer of geopolitical tension to the incident, indicating that these cyber operations may be part of a broader strategy.
On November 9, the French Computer Emergency and Response Team (CERT-FR) released a technical attribution notice detailing the cyber-attack. It pointed out that Shahid Kaveh is affiliated with various purported hacktivist organizations, including CyberAveng3rs, Soldiers of Solomon, Mr. Soul, and Cyber Isnaad Front. Investigators from the Anti-Criminality Office (OFAC) along with the French domestic intelligence service (DGSI) discovered IP addresses tracing back to Iran, as well as traces of Farsi language in the digital footprints left by the attackers. This points to a deliberate effort to cover their tracks, but also reveals carelessness that has been exploited to establish connections to Iranian origins.
Moreover, the techniques, tactics, and procedures (TTPs) employed in these attacks mirror those used in earlier Shahid Kaveh operations, signaling a consistent methodology that can potentially be traced and anticipated in future attacks. Consequently, three figures linked to the IRGC and Shahid Kaveh have been named in response to this alarming development.
In light of the severity of the situation, the Paris prosecutor’s office has initiated a judicial investigation to assess the cyber-attacks and the extent of the damage inflicted on the affected supermarkets. It is evident that these attacks were not merely random acts of cybercrime but rather a meticulously planned operation with far-reaching implications.
### France Vows to Take Punitive Measures
The French government has issued a strong statement outlining its intention to implement a series of diplomatic and punitive measures in response to these attacks. On November 9, officials announced their plan to summon the Iranian Ambassador to France, with the objective of conveying France’s utmost condemnation of the cyber incursions. Additionally, the government is pushing its European allies to impose further sanctions on Iranian individuals and entities that may have played a role in these cyber operations, as well as other malicious cyber activities.
French authorities underscored their determination to reserve the right to take additional measures, both public and covert, should they consider them necessary or proportionate in addressing these emerging cyber threats. The statement reflects a new paradigm in how France views cybersecurity in relation to international relations and national defense.
### First Nation-State, Sabotage-Focused Cyber-Attack on French Soil
Historically, France has been cautious in attributing cyber-attacks to specific nation-states. However, this particular incident marks a departure from that trend, underscoring its unprecedented nature. The French government characterized it as a “first cyber-offensive campaign” geared specifically towards sabotage within its borders, thereby escalating the stakes in international cybersecurity discussions.
Public sector CTO Gary Barlet from Illumio remarked on the significance of France’s decision to pursue coordinated sanctions at the European level. He stated that while the exact nature of these sanctions remains uncertain, it is crucial for France to take decisive action. Barlet emphasized that failure to follow through allows attackers to perceive minimal repercussions for their actions, thereby emboldening future assaults.
In the technical notice released by CERT-FR, officials pointed out that this cyber incident adds to a series of increasingly aggressive operations linked to IRGC-associated groups since at least 2020. Among these are destabilization efforts targeting notable entities, including the satirical newspaper Charlie Hebdo earlier this year and preparations related to the Paris 2024 Olympic and Paralympic Games.
Interestingly, the attribution of responsibility does not extend to other high-profile incidents, such as the cyber-attack on the French Blood Service (EFS) that occurred in early November, indicating that the threat landscape remains complex and multifaceted.
As the situation unfolds, the implications of this cyber offensive will likely resonate far beyond the immediate damage inflicted, marking a crucial juncture in how France—and possibly Europe—will define its strategies against cyber threats moving forward.