France says an IRGC unit hit about 700 sites; its report lists four indicators, none an IP address

France's report lists four indicators for the fridge attack, and none is an IP address

On 9 November 2026 the French foreign ministry published a statement of attribution saying that a campaign against refrigeration controllers at "plus de 700 sites de la grande distribution" (this site's rendering: more than 700 retail sites) can be attributed to Iran, through the unit SHAHID KAVEH. The ministry says the C4, the French cyber crisis coordination centre, published a joint report alongside it. CERT-FR catalogues that report as CERTFR-2026-CTI-009 (page, PDF), and its section on the grounds for the October attack lists four bulleted indicators (derived: counted from the report). None of the four is an IP address. The only IP addresses the report mentions, two belonging to Iranian internet providers, belong to a different case, the 2024 Paris Olympics display screens compromise, and the report prints neither address. The attribution came 28 days after the attack night of 11 to 12 October (derived: 12 October to 9 November).

That does not mean the attribution is wrong. It means that what France has made public is a set of indicators that a reader cannot test from the text. The report calls the set a "faisceau d’indices" (a bundle of indicators, this site's rendering) and gives no weighting. The claim is France's: the ministry and the C4 are the parties making it, and they are also the parties holding the underlying data. This site writes "France says" throughout and does not write that Iran did it.

The ministry statement, the CERT-FR page and the report were read in full. The Paris prosecutor's own text was not: the court's website answered with a maintenance page, so the prosecutor's investigation and arrest warrant request rest here on two press reports, The Record and CBC (Reuters copy). The Record is the news site of Recorded Future, a threat intelligence company. All times are as read between 20:36 and 20:55 UTC on Monday 9 November 2026.

Who said what, in which document

Four statements carry the story, two in documents this site read and two in press paraphrase. The table gives the exact French where the text was read, with this site's English rendering marked as such. The foreign minister is referred to only in his official capacity and no individual is named.

What the report says happened, in its order

The report says the C4 was alerted on 12 October 2026 to an attack on the refrigeration controllers ("contrôleurs de froid") of about 700 retail sites in France. After the compromise on the night of Sunday 11 to Monday 12 October, it says, "les paramètres de dégivrage des équipements ont été modifiés pour être fixés à de hautes températures" (the equipment's defrost parameters were changed to be set at high temperatures, this site's rendering), "entraînant des pertes de marchandise importantes et dans au moins 15 cas des départs de feu" (leading to significant loss of goods and, in at least 15 cases, fire outbreaks).

The report names the retail groups "Casino, Leclerc, Coopérative U, Metro, Carrefour et Intermarché" as the main entities affected, as the report prints them; no fault is implied by that. It adds other victims in food production, including several small butchers, an abattoir and cooperative food factories. It also says the C4 saw, at the same time and linking it to the same attack, several Schneider Electric devices at small hydroelectric installations targeted, with moderate effects on the devices.

Zoom

The four indicators, and what each leaves open

The report's section on the grounds for attributing the October attack opens by repeating that there is a bundle of indicators pointing to the Revolutionary Guard Corps as sponsor and the unit as executor, then lists four items. The table renders each in English (this site's rendering) and sets beside it what the report does not say. The right hand column is this site's reading of the silence, not a claim that the evidence is weak: the report may rest on material it has not published.

On IP addresses: the report mentions them once, for the 2024 Olympics case, saying the attackers used "deux adresses IP appartenant à des FAI iraniens" (two IP addresses belonging to Iranian internet providers) on the victim's network, and it prints neither. For the October attack the report lists no IP address and this site found none in the ministry statement. This site did not read the Paris prosecutor's text, so it cannot say whether that office cites any address.

The report also names the head of the parent centre and two commanders of the Shahid Kaveh unit in an annex with photographs. This site does not repeat the names. Press says the prosecutor seeks warrants for the unit's head and two deputies; the report's annex gives a different set of titles (one head of the parent centre, two commanders of the unit), and this site does not match people to roles.

Zoom

Labels doing the work of evidence

Two labels carry weight in this story. The first is the hacktivist name. The report says the unit is known mainly through "avatars numériques hacktivistes" (hacktivist digital avatars), listing CyberAveng3rs, Soldiers of Solomon, Mr. Soul and Cyber Isnaad Front, and that these avatars are tasked with publicly claiming some of its attacks. France is saying that a vigilante name is a front. That is a claim about those names, and the report prints no claim of the October attack made under any of them; what it prints is the relay on CyberbanNews.

The second is the phrase "bundle of indicators". A bundle sounds stronger than one item, but the report states neither how many indicators would be enough nor how the four are weighed. Whether the four are independent of each other is not stated either: this site notes that the first two (shared infrastructure, the scan tool) both describe how the operators worked, and does not know whether they would count as one or two. That is this site's reading.

Where the sources differ

The ministry statement and the report, both published on 9 November, differ from each other on three points, and the press accounts differ from both. This site does not choose between them.

Which devices: the documents name no maker

The ministry says "contrôleurs de réfrigération de supermarchés" and the report says "contrôleurs de réfrigération industriels français" (French industrial refrigeration controllers). Neither names a maker, model, firmware version, vulnerability identifier or advisory for them. Press reports and earlier briefs on this site name makers; the French documents do not.

Schneider Electric appears in the report in three other places: as equipment of small hydroelectric installations that the C4 says were targeted at the same time, as the brand on which the unit ran reconnaissance in April 2026, and, with Siemens and Rockwell, as brands for which the report says the unit has held scripts to scan, access and control industrial equipment since at least June 2024. The report does not say that the refrigeration controllers were Schneider Electric devices.

This site's earlier briefs record what the makers, agencies and researchers said when they were read: Danfoss on end of life units and no link to Claroty's flaws, the second wave of 2 November, CISA and the FBI on industrial cooling attacks and SecurityScorecard on a suspected spam botnet and Copeland XWEB PRO controllers. In that last brief SecurityScorecard says it has not linked the botnet to the freezer attacks, and the French documents do not mention it. Nothing in the French documents links any of those findings to this attribution, and this site does not.

The fires: who says what

The ministry says the attacks "ont causé des dégâts matériels considérables, des départs d’incendie" (caused considerable material damage, fire outbreaks). The report puts a number, at least 15, and a chain: settings changed, then losses and fires. Both are France's statements. The Record's headline, "some caused fires", repeats them and its text attributes the 15 to the French authorities.

CBC, in its own voice and without citing a fire service or a named site in the text read, writes "Some refrigerators had the temperature turned up so high they caught fire". Neither document says where the fires happened, what burned, whether anyone was hurt, or how each fire was tied to the changed settings. This site did not find an independent account of any individual fire in the pages read.

Next steps as stated, and their status

What France states, and what it does not

What to do, in order

Most of this list is this site's suggestion, not French advice: the French documents contain no defender guidance. The report's own facts are marked as such. It matters regardless of who is behind the attack, because the report's own description is a change to settings on controllers that someone could reach.

Technical details

The report prints no IP address, hash, domain or log line for the October attack. The blocks below are what it does print, copied as published, in French. Each is attributed in its caption. The report is the French state's document and the items are France's claims.

The four indicators. This is the report's list of grounds for attributing the October attack, with the footnote marker removed. A defender uses it as a checklist of what to look for in their own telemetry: whether controllers or industrial gateways were scanned from the same infrastructure, and whether anything is reachable on port 502.

• L’infrastructure utilisée pour mener l’attaque a également été utilisée, au cours de la même période, pour mener des actions de reconnaissance sur des équipements Schneider Electric, utilisés notamment dans des petites et moyennes unités de production d’énergie et d’eau. Les techniques utilisées lors de ces actions sont connues pour être utilisées par l’unité Shahid Kaveh depuis avril 2026 a minima (protocole Modbus / port 502) ;
• Pour mener l’attaque sur les systèmes de réfrigération français, les opérateurs ont utilisé l’outil de scan FOFA. Cet outil est habituellement utilisé par le mode opératoire d’attaque dans les différentes actions qu’il mène ;
• La cyberattaque ciblant les contrôleurs de réfrigération a été relayée sur l’organe de propagande CyberbanNews, associé à l’unité Shahid Kaveh, dès le 13 octobre 2026 ;
• Des traces d’utilisation du farsi ont été retrouvées dans l’infrastructure d’attaque.

The effect on the controllers. This is the report's description of what the attackers changed. A defender checks whether their own controllers log or alarm on changes to defrost parameters. The report gives no parameter names, values or registers.

les paramètres de dégivrage des équipements ont été modifiés pour être fixés à de hautes températures, entraînant des pertes de marchandise importantes et dans au moins 15 cas des départs de feu

Names the report uses for the unit and its fronts. These are actor names, not infrastructure. Use them to match threat intelligence feeds, and do not treat a mention of a hacktivist name as proof of anything on its own, for the reason given above.

principalement connue à travers ses avatars numériques hacktivistes, parmi lesquels CyberAveng3rs, Soldiers of Solomon, Mr. Soul, Cyber Isnaad Front, ainsi que par son organe de communication en ligne CyberbanNews.

The 2024 case, not the October attack. The report prints one domain, a news website, from the 2024 Paris Olympics display screens case, already defanged in the report, and refers to two IP addresses of Iranian internet providers without printing them. Do not block a news site on this basis.

jahannews[.]com
deux adresses IP appartenant à des FAI iraniens

The question the report leaves open

The report says four indicators form a bundle pointing to the Revolutionary Guard Corps. Which of the four could another operator have produced on purpose, and which can anyone outside the C4 check?

Key facts