French Authorities Attribute Smart Refrigeration Controller Sabotage via Modbus/BACnet/IP to IRGC Shahid Kaveh Unit

French authorities, supported by ANSSI, have attributed a large-scale sabotage campaign against approximately 700 retail refrigeration controllers to Iran’s IRGC Shahid Kaveh Unit. On October 11, 2026, actors exploited internet-exposed industrial control system (ICS) management interfaces to manipulate defrost cycle setpoints, inducing continuous heating cycles. This unauthorized modification of Modbus and BACnet/IP parameters resulted in widespread food spoilage and at least 15 localized fires. The attack signifies a strategic shift by Shahid Kaveh from cyber-espionage toward kinetic-impact OT disruption within critical food and medicine supply chains, prompting urgent joint advisories from CISA and the FBI.

• Incident Overview: French Retail Cold-Chain Sabotage

  • Approximately 700 supermarket and retail sites targeted on the night of October 11, 2026.
  • Attributed by ANSSI and the French Ministry of the Interior to the IRGC Shahid Kaveh Unit.
  • Physical consequences included massive food spoilage and at least 15 fires from overheated refrigeration units.
  • Prompted a multi-agency U.S. advisory from CISA, FBI, HHS, USDA, and DOT.

• Attack Vector: OT Controller Manipulation

  • Actors targeted internet-exposed smart refrigeration controller management interfaces for initial access.
  • Leveraged ICS/OT protocols, including Modbus and BACnet/IP, to inject unauthorized commands.
  • Altered defrost cycle configuration parameters to force continuous heating/defrosting cycles.
  • Exploited remote access services to modify device logic and temperature setpoints.

• Threat Group Profile: Shahid Kaveh Unit (IRGC)

  • Specialized cyber element of Iran's Islamic Revolutionary Guard Corps (IRGC).
  • Historical precedent includes intrusions targeting U.S. water utility infrastructure.
  • Demonstrating an operational evolution from espionage toward disruptive, physical-impact OT attacks.
  • Targets include grocery retail, cold storage, and pharmaceutical supply chain logistics.

• Mitigation and Defensive Actions

  • Disconnect all refrigeration controller management interfaces from public-facing internet networks.
  • Implement strict network segmentation to isolate ICS/OT protocols from IT environments.
  • Audit controller configuration parameters and defrost setpoints for unauthorized modifications.
  • Monitor Modbus and BACnet/IP traffic for anomalous administrative commands or unauthorized sessions.