# IRGC units Shahid Shoostari, Kaveh hit France

Published: 2026-11-09 · Severity: routine · Sectors: Infrastructure, Media, Manufacturing
Canonical: https://vorant.io/reports/cb3e3e53-6c8f-558f-a30b-3bfa21b3d868/irgc-units-shahid-shoostari-kaveh-hit-france
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> CERT-FR attributes destabilization attacks on French industrial refrigeration controllers and other targets to IRGC cyber units Shahid Shoostari and Shahid Kaveh.

Source: cert.cyber.gouv.fr — https://www.cert.cyber.gouv.fr/cti/CERTFR-2026-CTI-009

## What to check

- Applies to: Whether this concerns you is not assessed; the names the report mentions are listed below.

The French CERT (C4 coordination body, including ANSSI, COMCYBER, DGA, DGSE and DGSI) reports a series of destabilization-focused cyber attacks against French interests attributed to the Shahid Shoostari and Shahid Kaveh units operating within Iran's IRGC Cyber Electronic Command (CGRI-CEC). The most recent and notable incident, on 11-12 October 2026, targeted French industrial refrigeration controllers and is described as unprecedented in scale and aggressiveness compared to prior activity attributed to the same actors.

This incident follows a pattern of attacks against French targets dating back to at least 2020, including a 2023 operation against satirical magazine Charlie Hebdo and a 2024 attack against a French video display/digital signage company tied to the Paris 2024 Olympic and Paralympic Games. The report characterizes these as deliberate destabilization campaigns rather than traditional espionage, reflecting a pattern of IRGC-linked offensive cyber activity against French civil society, media, event infrastructure, and now industrial control systems. No technical indicators, malware, exploited CVEs, or detailed TTPs are disclosed in this bulletin; it functions as an attribution and situational-awareness notice for French defenders and critical-infrastructure operators.

Defenders in France, particularly operators of industrial/OT systems such as refrigeration and building control, as well as media and event-related organizations, should treat this as a signal of sustained, targeted interest from IRGC-affiliated units and review monitoring for anomalous ICS/OT access and destabilization-style intrusions (defacement, data destruction, service disruption) rather than purely espionage-driven TTPs.

## Mentioned in this report

- Threat actors: Shahid Kaveh, Shahid Shoostari

Source reporting: https://www.cert.cyber.gouv.fr/cti/CERTFR-2026-CTI-009

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/cb3e3e53-6c8f-558f-a30b-3bfa21b3d868/irgc-units-shahid-shoostari-kaveh-hit-france.
In the app the same report carries live profiles of the actors it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup