French authorities have accused Shahid Kaveh, a cyber unit linked to Iran’s Islamic Revolutionary Guard Corps (IRGC), of orchestrating a sabotage campaign that targeted refrigeration systems in hundreds of French supermarkets. The incident, which occurred in mid-October, involved remotely increasing temperatures in commercial cooling units, resulting in the spoilage of millions of euros worth of food.
France’s Foreign Minister Jean-Noel Barrot described the incident as unprecedented in its level of aggression. The Paris prosecutor’s office specifically identified Shahid Kaveh as an offensive cyber unit affiliated with the IRGC’s Cyberelectronic Command (CEC). French intelligence agencies stated that the attack targeted 700 commercial sites across the country.
French Intelligence Identifies Perpetrators
A joint report by French spy and cyber agencies named three individuals as key figures in the operation. Hamid Reza Lashgarian is identified as the head of the CEC. Mahdi Lashgarian and Reza Salarvand are listed as commanders within the Shahid Kaveh unit. Both Hamid Reza Lashgarian and Mahdi Lashgarian have previously been sanctioned by the United States for their alleged ties to the IRGC’s cyber operations.
French intelligence also revealed that Shahid Kaveh operates through a network of front groups that pose as vigilante hackers. These groups, including CyberAveng3rs and Cyber Isnaad Front, are tasked with publicly claiming responsibility for attacks carried out by the main unit. This structure allows the IRGC to maintain plausible deniability while projecting power and disrupting adversaries.
Iran Denies Involvement
Iran has firmly rejected the accusations. In a statement released on Tuesday, the Iranian Foreign Ministry called the allegations baseless and biased. The ministry described the accusations as a highly irresponsible action intended to tarnish Iran’s image and disrupt its relations with other countries. Tehran warned that it would take measures to safeguard its national interests and security.
The Iranian government has never publicly acknowledged the existence or purpose of Shahid Kaveh. The group is believed to be named after Mahmoud Kaveh, an IRGC commander who died at age 25 in 1986 during the Iran-Iraq war. Western intelligence agencies, however, have consistently linked the group to Tehran, assessing it as part of a broader network of hackers operating under Iranian direction.
Broader Context of Iranian Cyber Operations
Experts note that Iran has been increasingly using cyber capabilities to advance its strategic objectives. Nikita Shah, a senior fellow with the Intelligence, National Security, and Technology programme at the Center for Strategic and International Studies (CSIS), highlighted a notable uptick in Iran’s cyber operations since March 2026. This includes activities ranging from cyberespionage to conflict-themed cybercrime.
Shah noted in an August analysis that Iranian cyber operators are likely preparing new technical accesses and capabilities. These preparations could be leveraged if regional conflicts continue or if diplomatic negotiations falter. A 2025 policy report by the UK Parliament’s Intelligence and Security Committee described Iran as an aggressive cyber actor with extensive capabilities, noting that while its technology may not match that of Russia or China, it is effective at exploiting basic vulnerabilities.
Iran-linked groups have previously targeted critical infrastructure in the United States and Israel. In late 2023, attacks targeted US water facilities using systems from Israeli firm Unitronics. Earlier this year, hackers disrupted programmable logic controllers in US industrial sectors, causing operational disruption and financial loss. In March, an Iran-linked group claimed responsibility for a destructive attack on US medical device provider Stryker.
The recent French intelligence report concluded that attacks by Shahid Kaveh and its affiliates have been primarily directed against Israel and the United States, but also extend to France and other European countries. The supermarket sabotage marks a significant escalation in the use of cyber tools against civilian commercial infrastructure in Europe.
Source: Al Jazeera
