IRGC units Shahid Shoostari, Kaveh hit France
CERT-FR attributes destabilization attacks on French industrial refrigeration controllers and other targets to IRGC cyber units Shahid Shoostari and Shahid Kaveh.
Sourcecert.cyber.gouv.fr — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
The French CERT (C4 coordination body, including ANSSI, COMCYBER, DGA, DGSE and DGSI) reports a series of destabilization-focused cyber attacks against French interests attributed to the Shahid Shoostari and Shahid Kaveh units operating within Iran's IRGC Cyber Electronic Command (CGRI-CEC). The most recent and notable incident, on 11-12 October 2026, targeted French industrial refrigeration controllers and is described as unprecedented in scale and aggressiveness compared to prior activity attributed to the same actors.
This incident follows a pattern of attacks against French targets dating back to at least 2020, including a 2023 operation against satirical magazine Charlie Hebdo and a 2024 attack against a French video display/digital signage company tied to the Paris 2024 Olympic and Paralympic Games. The report characterizes these as deliberate destabilization campaigns rather than traditional espionage, reflecting a pattern of IRGC-linked offensive cyber activity against French civil society, media, event infrastructure, and now industrial control systems. No technical indicators, malware, exploited CVEs, or detailed TTPs are disclosed in this bulletin; it functions as an attribution and situational-awareness notice for French defenders and critical-infrastructure operators.
Defenders in France, particularly operators of industrial/OT systems such as refrigeration and building control, as well as media and event-related organizations, should treat this as a signal of sustained, targeted interest from IRGC-affiliated units and review monitoring for anomalous ICS/OT access and destabilization-style intrusions (defacement, data destruction, service disruption) rather than purely espionage-driven TTPs.
Mentioned in this report
Source reporting: https://www.cert.cyber.gouv.fr/cti/CERTFR-2026-CTI-009
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the actors it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs