[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f-e3r0FoTwKe85NK-rtZXoEDj1o_NoIoCVFsTuLaFK7g":3},{"article":4,"iocs":52,"watch_terms":57,"solutions":58,"lesson":153},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":29,"category":30,"article_tags":34},"23d373ac-6fa8-4a69-8157-7a4470e0977a","France blames Iran for supermarket hack meltdowns","france-blames-iran-for-supermarket-hack-meltdowns-c0fdc6","The 'first cyber offensive campaign carried out purely for the purpose of sabotage on national territory'","France has attributed a large-scale cyberattack targeting refrigeration controllers at over 700 grocery stores to Iran's Islamic Revolutionary Guard Corps' (IRGC) Shahid Kaveh cyber unit, also known as CyberAv3ngers. The attacks, which occurred in October, caused significant food spoilage and sparked fires, resulting in tens of millions of euros in losses. France stated this was the first cyber offensive campaign purely for sabotage on its national territory and vowed to respond using all available means.","France blames Iran for cyberattacks targeting supermarket refrigeration systems, causing food spoilage and fires.","https:\u002F\u002Fwww.theregister.com\u002Fsecurity\u002F2026\u002F11\u002F09\u002Ffrance-blames-iran-for-supermarket-hack-meltdowns\u002F5308591","https:\u002F\u002Fimage.theregister.com\u002F?imageId=258036&width=800","2026-11-09T22:45:21+00:00","2026-11-09T23:00:13.105249+00:00",8,[17,20,22,25,27],{"name":18,"type":19},"CyberAv3ngers","threat_actor",{"name":21,"type":19},"Shahid Kaveh",{"name":23,"type":24},"Schneider Electric","vendor",{"name":26,"type":24},"Siemens",{"name":28,"type":24},"Rockwell","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":29,"icon":31,"name":32,"slug":33},null,"Nation-state","nation-state",[35,37,42,47],{"category":36},{"id":29,"icon":31,"name":32,"slug":33},{"category":38},{"id":39,"icon":31,"name":40,"slug":41},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":43},{"id":44,"icon":31,"name":45,"slug":46},"d6f63bb8-0801-486a-be7f-171400700454","IoT\u002FOT","iot-ot",{"category":48},{"id":49,"icon":31,"name":50,"slug":51},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[53],{"type":54,"value":55,"context":56},"mitre_attack","T1560","Techniques used during these actions are known to have been used by the Shahid Kaveh unit since at least April 2026",[23,26,28],{"controls":59,"vendors":147},[60,89,118],{"slug":61,"name":62,"problem":63,"products":64},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[65,73,81],{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"slug":90,"name":91,"problem":92,"products":93},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",[94,102,110],{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","zero-trust-endpoint-firewall","Zero Trust Endpoint Firewall","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fzero-trust-endpoint-firewall","Centrally managed host firewall with device-level and dynamic access rules, to limit which machines can talk to each other.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","guardicore-segmentation","Akamai Guardicore Segmentation","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fakamai-guardicore-segmentation","Software-based microsegmentation with traffic visibility.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"illumio","Illumio","\u002Fvendor-logos\u002Fillumio.png","illumio-segmentation","Illumio Segmentation","https:\u002F\u002Fwww.illumio.com\u002Fillumio-segmentation","Maps traffic between workloads and enforces segmentation across data centre, cloud and endpoints.",{"slug":119,"name":120,"problem":121,"products":122},"ot-security","OT and industrial control system security","Factory, building and utility control systems get visibility and protection.",[123,131,139],{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-ot-security","Tenable OT Security","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fot-security","Asset inventory, vulnerability and threat detection for industrial networks.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"claroty","Claroty","\u002Fvendor-logos\u002Fclaroty.png","xdome","Claroty xDome","https:\u002F\u002Fclaroty.com\u002Findustrial-cybersecurity\u002Fxdome","Asset inventory, vulnerability management and threat detection for industrial networks.",{"vendor_slug":140,"vendor_name":141,"vendor_logo":142,"product_slug":143,"product_name":144,"url":145,"description":146},"dragos","Dragos","\u002Fvendor-logos\u002Fdragos.png","dragos-platform","Dragos Platform","https:\u002F\u002Fwww.dragos.com\u002Fcybersecurity-platform\u002F","OT asset visibility, threat detection and response guidance for industrial environments.",[148],{"slug":149,"name":26,"logo_path":150,"roles":151},"siemens","\u002Fvendor-logos\u002Fsiemens.png",[152],"affected",{"slug":154,"title":155,"body":156,"framework_refs":157,"framework_notes":165},"iran-linked-hackers-sabotage-french-supermarket-refrigeration-systems","Iran-Linked Hackers Sabotage French Supermarket Refrigeration Systems","Iran's IRGC-affiliated CyberAv3ngers unit was able to remotely compromise refrigeration controllers across more than 700 French grocery stores, causing food spoilage, fires, and tens of millions of euros in damages. The root issue lies in operational technology (OT) devices — industrial controllers — being exposed or insufficiently isolated from networks where threat actors could reach and manipulate them. This incident demonstrates that critical infrastructure OT systems are high-value sabotage targets, not just espionage ones. When physical control systems lack proper network segmentation and hardened configurations, a single intrusion campaign can cascade into real-world, kinetic harm at national scale.",[158,159,160,161,162,163,164],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","CIS Control 17: Incident Response Management","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIS2 Article 21(2)(b)","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","MITRE ATT&CK T1566: Phishing",{"NIS2 Article 21(2)(b)":166,"MITRE ATT&CK T1566: Phishing":167,"NIST SP 800-53 SI-2: Flaw Remediation":168,"CIS Control 17: Incident Response Management":169,"CIS Control 7: Continuous Vulnerability Management":170,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":171,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":172},"NIS2 mandates incident handling and security measures for operators of essential services — the grocery and food supply chain falls within scope, and compliance would have required baseline OT security controls that could have deterred this attack.","CyberAv3ngers frequently gains initial access through phishing; ensuring staff cannot inadvertently expose OT network credentials via phishing would have been a critical first line of defense in this campaign.","SI-2 requires organizations to identify, report, and remediate flaws in information systems — including OT components — within defined timeframes, which would have reduced the attack surface on the refrigeration controllers.","A tested OT incident response plan would have enabled faster containment of the sabotage, potentially limiting the spread of damage across all 700+ affected store locations.","Regular vulnerability scanning and timely remediation of industrial controller firmware would have identified and closed the weaknesses CyberAv3ngers exploited before the attack campaign launched.","A.8.8 requires timely identification and remediation of technical vulnerabilities in all assets, including embedded OT firmware, which is precisely the attack vector used to compromise the refrigeration systems.","Enforcing strong authentication and least-privilege access on refrigeration controller management interfaces would have prevented or significantly hindered the attackers' ability to send destructive commands remotely."]