The French government has accused Shahid Kaveh – a group it says is linked to Iran’s Islamic Revolutionary Guard Corps (IRGC) – of being behind recent cyberattacks targeting refrigerators in French supermarkets.
asserted
it → accuse → supermarkets
The alleged sabotage campaign last month hacked into refrigeration systems in hundreds of stores in France and remotely cranked up temperatures, spoiling millions of euros’ worth of food.
asserted
campaign → allege → food
Recommended Stories
list of 3 items- list 1 of 3Iran sees ‘false flag’ operations after UK blames IRGC for airbase incident
- list 2 of 3Netanyahu promises Iran regime change: Can Israel topple Tehran government?
- list 3 of
asserted
Israel → see → government
3Espionage threats blur lines between security and dissent in Iran
France’s Foreign Minister Jean-Noel Barrot has called the attack “unprecedented in its level of aggression”.
asserted
Barrot → blur → aggression
But in a statement on Tuesday, Iran denied any role in the cyberattacks.
asserted
Iran → deny → cyberattacks
Here’s what we know about Shahid Kevah and its alleged involvement:
What has France accused Iran of?
asserted
France → ’ → Iran
French officials have accused the IRGC of orchestrating the October 11-12 cyberattack, which they say targeted 700 commercial sites across France.
asserted
they → accuse → France
In a statement, the Paris prosecutor’s office specifically blamed Shahid Kaveh, which it described as a “an offensive cyberunit” affiliated with the IRGC’s cyberelectronic command (CEC).
asserted
it → blame → command
A report published by France’s spy and cyberagencies also named three alleged perpetrators – Hamid Reza Lashgarian, who it described as the head of the CEC, and Mahdi Lashgarian and Reza Salarvand, who it identified as commanders in the Shahid Kaveh unit.
asserted
it → publish → unit
How has Iran responded?
asserted
Iran → respond → ?
Iran pushed back against the accusations on Tuesday, calling them “baseless and biased”.
asserted
Iran → push → them
The Iranian Foreign Ministry, in a statement, described the accusations as a “highly irresponsible and contemptible action to tarnish Iran’s image and disrupt its relations with other countries”.
asserted
Ministry → describe → countries
The statement warned that Tehran would not hesitate to take measures to safeguard its national interests and security.
asserted
Tehran → warn → interests
It made no mention of the Shahid Kaveh unit.
asserted
It → make → unit
Iran’s government has never publicly acknowledged the existence or purpose of the group, which appears to be named after Mahmoud Kaveh, an IRGC commander who died aged 25 in 1986 during the Iran-Iraq war.
asserted
who → acknowledge → war
But Western intelligence agencies have linked it to the IRGC, assessing that it is part of a network of hackers operating under Tehran’s direction.
asserted
it → link → direction
In their recent report, French spy and cyber agencies said Shahid Kaveh operates through numerous front groups posing as vigilante hackers, including “CyberAveng3rs” and “Cyber Isnaad Front.”
asserted
Kaveh → say → CyberAveng3rs
Those front groups, it said, “are tasked with publicly claiming responsibility for certain attacks carried out by the Shahid Kaveh unit”.
asserted
it → say → unit
Two of the alleged associates named by French intelligence agencies – Hamid Reza Lashgarian and Mahdi Lashgarian – have previously been sanctioned by the US over alleged ties to the IRGC’s cyberunit.
asserted
Two → allege → cyberunit
What do we know about Iran’s cyberattack capabilities?
asserted
we → know → capabilities
Iran has extensive cybercapabilities that it is increasingly using to advance its wartime objectives, say experts.
asserted
experts → have → objectives
Nikita Shah, a senior fellow with the Intelligence, National Security, and Technology programme at the Center for Strategic and International Studies (CSIS), says there has been a “notable uptick in Iran’s cyberoperations since March 2026”, including “cyberespionage” and “conflict-themed cybercrime”.
asserted
Shah → say → cyberespionage
“Iran’s cyberoperators will likely be working on preparing new technical accesses, and possibly new cyber capabilities to leverage, should the conflict continue over the longer term or negotiations falter,” Shah wrote in an August analysis for CSIS.
uncertain
Shah → work → CSIS
A 2025 policy report by the United Kingdom Parliament’s Intelligence and Security Committee describes Iran as “an aggressive cyberactor with extensive capabilities”.
asserted
report → describe → capabilities
While Iran’s cybercapacity is not as sophisticated as Russia’s or China’s, according to the report, Tehran is adept at using basic exploitation methods against its adversaries.
“Whilst Iranian cyberactors often use simple computer network exploitation techniques, they use them very effectively, exploiting basic vulnerabilities that many organisations have, including in the UK,” said the report.
uncertain
report → accord → UK
Cyberoperations are also a “deniable tool” that Iran can use to “attack its enemies, respond to perceived aggression and project power in the region – and globally,” the report added.
asserted
report → use → region
Other than France, who else has been targeted?
asserted
who → target → France
The IRGC and affiliated groups have been linked to past cyberattacks on targets in the United States and Israel, including water infrastructure.
asserted
IRGC → affiliate → infrastructure
One wave of attacks in late 2023 targeted US water facilities that relied on a computer system made by Israeli software firm Unitronics, according to US cybersecurity officials.
uncertain
that → target → officials
Earlier this year, Iran-affiliated hackers also went after industrial control technology used in US infrastructure, including at government facilities, US security agencies warned.
asserted
agencies → affiliate → facilities
The hackers were able to disrupt some programmable logic controllers (PLCs) — technology that helps automate and monitor machinery and manufacturing processes — across several US critical infrastructure sectors, causing “operational disruption and financial loss”, the US agencies said.
asserted
agencies → disrupt → disruption
And in March this year, an Iran-linked hacking group claimed to carry out a destructive cyberattack on US-based medical device provider, Stryker.
asserted
group → link → provider
The recent French intelligence report said attacks by Shahid Kaveh and its affiliated groups have been “primarily directed against Israel and the United States, but also against France and other European countries”.
asserted
attacks → say → France
The Aporia
