.jpg)
The recent wave of cyber-attacks targeting refrigeration control systems across 700 supermarkets sites in France was coordinated by an Iranian hacking group, according to French authorities.
Laure Beccuau, the Paris Public Prosecutor, said on social media the investigation found links between the October 11 to 12 cyber-attack and the Shahid Kaveh and Shahid Shoostari groups, two elite offensive cyber units tied to Iran’s Islamic Revolutionary Guard Corps (IRGC).
In a technical attribution notice published on November 9, the French Computer Emergency and Response Team (CERT-FR) said Shahid Kaveh is linked to a range of purported hacktivist groups, including CyberAveng3rs, Soldiers of Solomon, Mr. Soul and Cyber Isnaad Front.
Investigators from the Anti-Criminality Office (OFAC) and the French domestic intelligence service (DGSI) found IP addresses linked to Iran-based endpoints and observed Farsi words in the traces left by the hackers.
Additionally, the techniques, tactics and procedures (TTPs) employed by the attackers were consistent with previous Shahid Kaveh campaigns.
CERT-FR named three leaders of the IRGC and Shahid Kaveh linked to the cyber-attacks.
The Paris prosecutor's office has now opened a judicial investigation into the cyber-attacks and the damage caused.
France Vows to Take Punitive Measures
According to another statement issued by the French government on November 9, Paris intends to take a series of diplomatic and punitive measures in response to the cyber-attacks.
The government announced that it would summon Iran’s Ambassador to France to formally convey its strongest condemnation of the attacks.
It also stated that it would urge its European partners to introduce additional sanctions targeting Iranian individuals and entities allegedly involved in the cyber-attacks against France, as well as other malicious cyber activities.
The French government stressed that it reserves the right to take further measures, both public and undisclosed, should they be deemed necessary and proportionate to respond to the cyber threats.
Frist Nation-State, Sabotage-Focused Cyber-Attack on French Soil
Historically, France has rarely attributed cyber-attacks to a single country, making this move particularly significant.
“This is an unprecedented campaign in terms of its scale and level of aggressiveness, marking the first cyber-offensive campaign carried out purely for sabotage purposes on French national territory,” the French government explained in its statement.
Commenting on the attribution, Gary Barlet, public sector CTO at Illumio, said he is also “impressed” that France is planning to pursue sanctions at a European level.
“It's not yet clear what form those sanctions will take, so that will be interesting to see. But this needs to happen more often. Too often an attack gets publicly called out, there's outrage, and then nothing happens. It sends a message to attackers that the cost of doing this is close to zero,” Barlet added.
In the CERT-FR technical notice, the French Cyber Crises Coordination Center (ordination des Crises Cyber (C4) said this attack added to a series of other incidents that have been attributed to IRGC-linked groups since at least 2020. These include destabilisation campaigns targeting satirical newspaper Charlie Hebdo in 2023 and a French digital display company in 2024, in the context of the Paris 2024 Olympic and Paralympic Games.
This attribution does not include the cyber-attack on the French Blood Service (EFS) that occurred in early November.
.jpeg)
