Attacks on Cold-Chain Infrastructure: The Hard Hunt for the Culprits

France holds Iran’s Revolutionary Guards responsible for the October refrigeration sabotage, and Tehran denies it. Pro-Russian hackers claim the second wave in November. What investigators know, and where they are stuck.

On Monday, France named three people. According to the French authorities, Hamid Reza Lashgarian heads the cyber centre of Iran’s Islamic Revolutionary Guard Corps (IRGC). Mahdi Lashgarian and Reza Salarvand command the Shahid Kaveh unit. It allegedly sabotaged the refrigeration systems of around 700 French food retail sites on the night of 11 to 12 October. That is the finding of a report by CERT-FR, the French government’s cyber emergency team.

The Paris prosecutor’s office has requested international arrest warrants. Foreign Minister Jean-Noël Barrot summoned Iran’s ambassador, announced EU sanctions and said the following day that Paris “rules nothing out”.

For the rest of Europe, the question of who did it remains open. Pro-Russian hackers claim the second wave in early November, which also hit Germany. No government has committed itself. We described in October how the attackers operated and why the sabotage was avoidable.

What has the hunt for the perpetrators turned up so far?

The key finding: there are two waves with two very different levels of knowledge. In France, according to CERT-FR, the attackers set the defrost parameters, the settings that regularly de-ice the units, to high temperatures. Fires broke out at least 15 times. For the second wave, Unit 42, the threat research team at Palo Alto Networks, counts 100 to 115 affected sites in at least ten countries. How the attackers got in remains unclear.

The same night, attackers hit the French blood service EFS. They reached cold rooms at three sites through the refrigeration contractor Coolworld, which blames a flaw in a third-party component. Monitoring raised the alarm quickly, and no blood products were lost.

In Germany, an Edeka supermarket in Reisbach, Bavaria, had to throw away vast quantities of food. In Wetter-Volmarstein, the attack targeted the company that remotely maintains the systems of a shop run by the welfare organisation Arbeiterwohlfahrt. Police are examining further cases in Wuppertal, the Münsterland region and the Western Palatinate (Tagesspiegel). In the Upper Palatinate, unknown attackers set the cold stores of a butcher’s shop to as high as 150 °C.

Who blames whom? France names Iran, but only for the October wave. Pro-Russian groups have claimed the November wave themselves. Several security firms consider a Russian trail plausible but do not commit. Moscow calls any involvement “absurd”, Tehran calls the accusations “baseless and one-sided”. Such denials carry little weight as evidence.

What points to Iran?

Behind the French attribution stands the C4 crisis centre, which brings together the cyber security agency ANSSI, the armed forces, the defence procurement agency and the intelligence services. Its strongest evidence is the infrastructure: at the same time, the attackers used the same servers to scout Schneider Electric controllers in small energy and water facilities. France has attributed this activity to Shahid Kaveh since April 2026. The unit scans the internet for devices that speak the industrial protocol Modbus.

Three further clues add to this: FOFA, a public search engine for connected devices that, according to the report, the unit routinely uses; traces of Farsi in the attack infrastructure; and the propaganda outlet CyberbanNews, which spread news of the attack from 13 October onwards. None of this amounts to a claim of responsibility.

The unit has a history with refrigeration technology. According to the French report, it claimed a sabotage campaign against Israeli and US targets in March and April, including refrigeration systems in Israel. The Pentagon, the FBI and the NSA consider Shahid Kaveh to be the same unit as the CyberAv3ngers group, which attacked controllers at US water utilities in 2023. The US State Department is offering up to 10 million dollars for information on six IRGC officers, including both Lashgarians (The Record).

Microsoft had also privately linked Iran to the October attacks, at least two weeks before the French announcement. The news agency Reuters reports this, citing three people familiar with the matter. Microsoft declined to comment.

The method has precedents. In May 2026, attackers tampered with setpoints, safety limits and alarm thresholds at an Israeli food plant. CO₂ escaped and three compressors were wrecked (Cooling Post). The Israeli security firm Profero attributes the attack to Cyber Isnaad Front, a front identity controlled by the Iranian state. Profero chief Omri Segev Moyal sees a pattern: “We’re observing targeted attacks gradually built and practiced against Israel, tested in Europe and the U.S., and unleashed [now].”

In late August, refrigeration failed at around six US military supermarkets. US officials suspect hackers linked to Iran, but the Pentagon has confirmed neither a cyberattack nor a perpetrator (Defense One).

A motive is not hard to find. On 28 February, the US and Israel went to war with Iran. At the end of January, Paris had already dropped its resistance to putting the Revolutionary Guards on the EU terror list. In July, France accused Iranian security forces of attacking two staff members of the French embassy, and in August it expelled two Iranian embassy staff.

What speaks against the Iran trail?

From the outside, almost none of this can be verified. The report gives no level of confidence and itself speaks of a “faisceau d’indices”, a bundle of circumstantial evidence. It contains no IP addresses for the refrigeration case. They would be weak evidence anyway, because attackers route their traffic through third-party servers and VPN services. An Iranian address can be a false trail just as easily as a Russian one.

Technical indicators of compromise, IoCs in industry jargon, are missing. Also unknown is how the attackers got into the controllers and where exactly the Farsi traces were found, as the French tech news site Next points out. The arrest warrants have been requested, not issued.

The motive can be disputed. US Secretary of State Marco Rubio said of the US war with Iran: “France is not even involved in this, really” (NPR). Militarily, that is true. Diplomatically, it is not: the disputes over embassy staff and the Revolutionary Guards make Paris an adversary in Tehran’s eyes.

Why France of all places? A technical explanation is enough. On the day of the attack, the internet scanner Censys found 2,991 publicly reachable interfaces of Danfoss’s StoreView system worldwide. Six in ten were in France (Infosecurity Magazine). Anyone looking for open doors finds them there first. That does not rule out a political motive.

The cross-check on Russia comes up thin. No pro-Russian group claimed the October wave. We noticed this back in October, because these groups usually like to boast. In the same week, NoName057(16) hit France with overload attacks on websites (DDoS) and claimed to have taken over a small hydropower plant. That has nothing to do with the supermarkets, concludes the security firm SOCRadar. One twist: the French report attributes attacks on small hydropower plants to the Iranian operation. Whether this concerns the same plant is unclear.

Paris does not go easy on Moscow either. In July, Barrot blamed Russia’s domestic intelligence service FSB for a cyber campaign against ten European states and announced that he would summon the Russian ambassador. The Iran attribution therefore does not look like political convenience. For the October wave, Iran is the best-supported hypothesis. That Paris names individuals and seeks arrest warrants points to intelligence sources that are not public.

Why is it so hard to attribute cyberattacks?

Attackers lay false trails. In 2015, hackers from Russian military intelligence took the broadcaster TV5 Monde off air while posing as the Islamic State’s Cyber Caliphate (CFR). In 2019, the UK’s National Cyber Security Centre (NCSC) and the US intelligence agency NSA warned that the Russian group Turla had hijacked servers of the Iranian group OilRig and used them for its own attacks (CISA).

Names change, too. According to the French report, Shahid Kaveh operates under several aliases, including CyberAv3ngers and Cyber Isnaad Front. Such identities can be shared and faked. And the evidence stays secret because governments protect their sources: an attribution is a political statement, not a verdict.

Who is behind the second wave?

There is no government attribution for the November wave. In their joint statement of 4 November, the EU cyber security agency ENISA, the European Commission, Europol and the networks of national computer emergency response teams name no perpetrators. The C4 crisis centre has not yet attributed even the attack on the blood service, although the method resembles the October wave. If it did, that would be the first official link between the two waves.

The most visible trail is therefore the pro-Russian one. On 3 and 4 November, NoName057(16) and Z-Pentest claimed the attacks and published alleged login credentials of Danfoss employees and customers. Z-Pentest knows the target: the group hunts for internet-exposed industrial controllers and reported ten attacks on refrigeration systems on a single day, 26 April.

Denmark’s military intelligence service holds both groups responsible for a destructive attack on a Danish waterworks in 2024. According to the service, the Russian state uses them as tools in its hybrid war against the West. Since July, Z-Pentest has been on the EU sanctions list.

Then there are traces on the network. The security firm Lupovis runs decoy systems known as honeypots. Before the second wave, it registered scanning of Danfoss components only in Europe. The probes ran through bulletproof hosters, providers that evade the authorities. Some of them had previously been used by Russian groups. “When we pull on the thread it does look like it could well be Russia,” says Lupovis head Xavier Bellekens (Euronews). At the same time, Lupovis stresses that the location of a server says nothing about the nationality of the attackers.

But there are dissenting voices. Four analysts examined the published files for the Swedish broadcaster SVT. The files prove no access to any refrigeration system, and 168 of the 171 email addresses had already appeared in older data leaks. Danfoss sees no sign of a successful attack on its internal IT. Z-Pentest itself only wrote that the waves closely resembled its own earlier actions. Both groups’ Telegram channels have since been deleted.

Romania’s cyber chief Dan Cîmpean said: “We do not suspect, under any circumstances, that it is a state actor.” He called the attack “semi-amateurish” (Al Jazeera). Interim conclusion: the claim by the pro-Russian groups is the weakest of all the clues. So far, nothing proves a single perpetrator for the November wave.

How likely are copycats?

Likely, and of two kinds. The first kind copies the act. After the October wave the method was public knowledge, and the second wave came three weeks after CERT-FR’s first warning. “It doesn’t require much expertise,” Andrei Sabelfeld, a professor at Chalmers University of Technology in Gothenburg, told the broadcaster SVT. Lupovis counted more than 276 access attempts from 91 different actors in ten days. That does not mean 91 perpetrators, as many were merely probing. But the number shows how much interest the devices attract.

The access routes differ, too. In Wetter the attack ran through the maintenance company, at the blood service through the contractor, and Coop in Sweden points to old 4G connections. The mix of manufacturers proves little on its own: the first wave, which Paris attributes to a single actor, already hit controllers from Danfoss, Copeland and Dixell (Cybersecurity Dive). The different access routes point more to several perpetrators than to a centrally run operation.

The second kind copies the claim. NoName057(16) has repeatedly claimed other people’s attacks in the past. Nobody has confirmed the October hydropower plant attack to this day. The security firm SentinelOne considers independent ideological operators, copycats and financially motivated intruders, alongside state-linked actors, consistent with the public facts. One thing argues against greed: no one has demanded a ransom so far. The most plausible explanation is an organised core that copycats followed.

Conclusion: the culprits change, the door stays open

For France, the question of who did it has been answered; for Europe, it has not. The cause, by contrast, is clear: internet-exposed, outdated controllers and poorly secured remote maintenance. After the October wave, 71 per cent of the publicly reachable StoreView interfaces in France disappeared from the internet within three days. According to Censys, operators hardly patched them, that is, installed security updates. They pulled the plug. Worldwide, Forescout found almost 13,000 internet-reachable refrigeration control services, spread across 99 countries. Our recommendations from October still stand: take stock of your devices, keep them off the open internet, and secure remote maintenance with personal accounts and a second factor. Anyone looking for the saboteurs has found only clues so far. Anyone looking for open refrigeration controllers finds them in minutes.

Who is behind the attacks on supermarket refrigeration systems?

Paris holds the Shahid Kaveh unit of Iran’s Revolutionary Guards (IRGC) responsible for sabotaging around 700 French food retail sites in October 2026. Tehran rejects this as baseless. No government has named a perpetrator for the second wave in November, which hit at least ten European countries. The pro-Russian groups NoName057(16) and Z-Pentest have claimed it, but their evidence does not hold up.

What evidence has France presented against Iran?

France relies on a bundle of circumstantial evidence: servers shared with earlier operations, the search tool FOFA, traces of Farsi and distribution via an Iranian propaganda outlet. Paris has not published any technical indicators of compromise, so the attribution can hardly be checked from the outside.

Is the claim by NoName057(16) and Z-Pentest true?

It has not been independently verified. Four analysts working for the Swedish broadcaster SVT found no evidence in the published files of access to any refrigeration system. 168 of the 171 email addresses come from older data leaks.

Were German supermarkets affected too?

Yes. Shops in Reisbach, Wuppertal and Wetter-Volmarstein and a butcher’s shop in the Upper Palatinate reported tampered refrigeration systems on the night of 1 to 2 November. Police are investigating.

Are the attacks linked to the Node-RED takeovers?

There is no evidence of that. Since the end of October, attackers have been hijacking unsecured systems running Node-RED, open-source software for visually wiring together connected devices and data flows. We describe how they do it in a separate article.