[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f6zguQDumO7wDQCE7OWusOEUEyh7s1tz5ePmBgzhrgXQ":3},{"article":4,"iocs":52,"watch_terms":56,"solutions":57,"lesson":147},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":29,"category":30,"article_tags":34},"ebe93dbe-97d8-49cc-a222-6e47555e27b8","France blames Iran for fridge cyberattacks, says some caused fires","france-blames-iran-for-fridge-cyberattacks-says-some-caused-fires-b1e516","In the first attribution since the October attacks, the French authorities identified the perpetrators as part of Shahid Kaveh, an IRGC cyber unit previously linked to attacks on industrial controllers at U.S. water utilities.","French authorities have attributed a cyberattack targeting approximately 700 grocery stores, which caused significant food loss and at least 15 fires, to Iran's Islamic Revolutionary Guard Corps (IRGC). The perpetrators were identified as part of the Shahid Kaveh unit, previously linked to attacks on U.S. industrial controllers. France has summoned Iran's ambassador and plans to pursue European sanctions against those responsible.","France attributes cyberattacks on refrigeration systems to Iran's IRGC, causing fires and food loss.","https:\u002F\u002Ftherecord.media\u002Ffrance-blames-iran-for-fridge-cyberattacks","http:\u002F\u002Fcms.therecord.media\u002Fuploads\u002Ffridge_eeb57556f3.jpg","2026-11-09T18:45:00+00:00","2026-11-09T19:00:19.578779+00:00",8,[17,20,22,24,26],{"name":18,"type":19},"Shahid Kaveh","threat_actor",{"name":21,"type":19},"CyberAv3ngers",{"name":23,"type":19},"Shahid Shoostari",{"name":25,"type":19},"Emennet Pasargad",{"name":27,"type":28},"Schneider Electric","vendor","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":29,"icon":31,"name":32,"slug":33},null,"Nation-state","nation-state",[35,37,42,47],{"category":36},{"id":29,"icon":31,"name":32,"slug":33},{"category":38},{"id":39,"icon":31,"name":40,"slug":41},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":43},{"id":44,"icon":31,"name":45,"slug":46},"d6f63bb8-0801-486a-be7f-171400700454","IoT\u002FOT","iot-ot",{"category":48},{"id":49,"icon":31,"name":50,"slug":51},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[53],{"type":54,"value":21,"context":55},"malware","Identified as another name for the Shahid Kaveh group",[27],{"controls":58,"vendors":146},[59,88,117],{"slug":60,"name":61,"problem":62,"products":63},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[64,72,80],{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"slug":89,"name":90,"problem":91,"products":92},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",[93,101,109],{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","guardicore-segmentation","Akamai Guardicore Segmentation","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fakamai-guardicore-segmentation","Software-based microsegmentation with traffic visibility.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","zero-trust-endpoint-firewall","Zero Trust Endpoint Firewall","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fzero-trust-endpoint-firewall","Centrally managed host firewall with device-level and dynamic access rules, to limit which machines can talk to each other.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"illumio","Illumio","\u002Fvendor-logos\u002Fillumio.png","illumio-segmentation","Illumio Segmentation","https:\u002F\u002Fwww.illumio.com\u002Fillumio-segmentation","Maps traffic between workloads and enforces segmentation across data centre, cloud and endpoints.",{"slug":118,"name":119,"problem":120,"products":121},"ot-security","OT and industrial control system security","Factory, building and utility control systems get visibility and protection.",[122,130,138],{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"nozomi-networks","Nozomi Networks","\u002Fvendor-logos\u002Fnozomi-networks.png","guardian","Nozomi Networks Guardian","https:\u002F\u002Fwww.nozominetworks.com\u002Fplatform\u002Fguardian","Passive monitoring, asset inventory and threat detection for OT and IoT networks.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-ot-security","Tenable OT Security","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fot-security","Asset inventory, vulnerability and threat detection for industrial networks.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"claroty","Claroty","\u002Fvendor-logos\u002Fclaroty.png","xdome","Claroty xDome","https:\u002F\u002Fclaroty.com\u002Findustrial-cybersecurity\u002Fxdome","Asset inventory, vulnerability management and threat detection for industrial networks.",[],{"slug":148,"title":149,"body":150,"framework_refs":151,"framework_notes":159},"iran-linked-irgc-unit-hacks-french-grocery-refrigeration-systems-causing-fires","Iran-Linked IRGC Unit Hacks French Grocery Refrigeration Systems, Causing Fires","Iran's Islamic Revolutionary Guard Corps (IRGC), through its Shahid Kaveh unit, compromised industrial control systems managing refrigeration in approximately 700 French grocery stores, resulting in widespread food spoilage and at least 15 fires. This attack demonstrates that operational technology (OT) and industrial control systems (ICS) connected to networks are high-value, high-impact targets for nation-state actors. The fact that a known threat actor unit — previously linked to attacks on U.S. industrial controllers — was able to replicate similar attacks in France underscores the failure to apply lessons learned from prior incidents. When ICS\u002FOT systems are insufficiently isolated from external networks and lack robust monitoring, adversaries can cause real-world physical harm, including fires and economic loss. This incident is a stark reminder that cyber threats to critical infrastructure are no longer theoretical — they carry tangible, dangerous consequences.",[152,153,154,155,156,157,158],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","CIS Control 17: Incident Response Management","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIS2 Article 21(2)(b)","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","MITRE ATT&CK T1566: Phishing",{"NIS2 Article 21(2)(b)":160,"MITRE ATT&CK T1566: Phishing":161,"NIST SP 800-53 SI-2: Flaw Remediation":162,"CIS Control 17: Incident Response Management":163,"CIS Control 7: Continuous Vulnerability Management":164,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":165,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":166},"NIS2 explicitly requires incident handling measures for critical infrastructure operators; French grocery supply chain operators likely fall under NIS2 scope and should have had mandated OT security controls in place.","Nation-state ICS attacks, including those by IRGC-linked groups, frequently begin with phishing to gain initial network access; awareness and technical controls against phishing would have been a critical first line of defense.","NIST SI-2 requires organizations to identify, report, and correct information system flaws; applying this to OT\u002FICS environments would have mandated patching the industrial controllers targeted in this campaign.","A tested OT-specific incident response plan would have enabled faster containment of the compromised refrigeration controllers, potentially preventing the escalation to physical fires across 15 locations.","The Shahid Kaveh unit has a known history of targeting industrial controllers; continuous vulnerability scanning and timely remediation of ICS systems could have identified and closed exploitable weaknesses before the attack.","This control requires timely identification and remediation of technical vulnerabilities, which — if applied to ICS\u002FOT assets in the grocery supply chain — would have reduced the attack surface exploited by IRGC actors.","Enforcing strong authentication and access controls on industrial control systems would have limited the ability of IRGC actors to issue unauthorized commands to refrigeration units."]