The key facts
- France named three Iranians accused of attacks on refrigeration systems at about 700 commercial facilities on the night of October 12
- Among them is IRGC cyber command head Hamid Reza Lashgarian, previously sanctioned by the US and with a $10 million reward
- Iran does not acknowledge responsibility; Iran's ambassador has been summoned to Tehran
Accusations and diplomatic reaction
France has named three Iranian citizens it links to cyber operations against the country's interests, including attacks on the refrigeration systems of approximately 700 commercial facilities on the night of October 11-12. Hackers forcibly set the defrost settings of the controllers to high temperatures, which led to spoiled goods and at least 15 fires. The National reports this citing a report by French cybersecurity and intelligence agencies published on Monday.
Who has been accused
French Foreign Minister Jean-Noel Barrot called the attack
What is known about those implicated
The central figure is 65-year-old Hamid Reza Lashgarian, whom the US Treasury Department calls the head of the IRGC's Cyber-Electronic Command (IRGC-CEC) and a commander in the Quds Force. Washington imposed sanctions on him in February 2024, and in August announced a reward of up to $10 million for information about him. The second figure is 37-year-old Mahdi Lashgarian, also under US sanctions and with the same reward; France calls him the commander of the Shahid Kaveh unit, which it considers the perpetrator of the attacks on refrigerators. There is little independent confirmation of his biography. The third is Reza Salarvand, mentioned in 2021 in documents attributed to the Shahid Kaveh intelligence group; according to Iranian opposition press abroad, he is 35 years old and graduated from a branch of Islamic Azad University in southern Tehran in 2017. These details, as The National notes, have not been independently verified to the same extent as the identification in the French statement.
The unit and its traces
According to the French agencies' conclusion, Shahid Kaveh is an offensive cyber unit within the IRGC-CEC responsible for large-scale campaigns against industrial equipment. The attribution rests on several indicators: reused digital infrastructure, the use of the Fofa scanner, traces in Farsi, and statements through the unit's online channel CyberbanNews. The unit also operates through the CyberAveng3rs group, which the American cyber defense agency links to the November 2023 campaign against American industry and refers to under the aliases Hydro Kitten, Storm-0784, and APT Iran. France also links Shahid Kaveh to the November 2023 attack on the Israeli industrial controller manufacturer Unitronics and to sabotage against Israeli and American interests in March and April of this year.
Distinction from other operations
The French statement distinguishes Shahid Kaveh from another IRGC-CEC unit, Shahid Shustari (known as Emennet Pasargad), which has been linked to operations against the satirical magazine Charlie Hebdo, including the hacking of its online store in January 2023, and to the hack of a French video display company in July 2024 ahead of the Paris Olympics.
