Iran for Sabotage Attack on Refrigeration Controllers at About 700 Retail Sites

Iran is now the target of an action by law enforcement.

An October cyberattack on refrigeration controllers at about 700 French retail sites was carried out by a cyber unit of Iran's Islamic Revolutionary Guard Corps (IRGC), the French government said yesterday.

The attackers broke into controllers on the night of October 11 and changed their defrost settings to high temperatures.

France's Foreign Ministry plans to summon Iran's ambassador and to ask its European partners to adopt new sanctions against Iranian organizations and individuals involved in the attack.

The Paris prosecutor's office opened a judicial investigation yesterday against the unit's head, the head's two deputies and anyone else identified.

Most of the organizations hit were large retailers, according to a joint report by France's cyber crisis coordination center, known as C4.

Past victims of Iran are not made whole by this action alone, and anyone still running systems compromised before this action remains affected.

The offenses under investigation include illegally interfering with computer systems and causing damage by means dangerous to people, both made more serious by the aim of serving a foreign power, Iran.

Small butcher shops, a slaughterhouse and cooperative food plants were also among the victims.

An arrest or a seized domain disrupts the operation, but it doesn't undo what already happened to that operation's past victims, and it rarely accounts for every affiliate who can simply rebrand.

That caused food losses and, in at least 15 cases, fires.

In its attribution statement, the ministry estimated the food losses at several tens of millions of euros and called the operation the first offensive cyber campaign on French soil carried out purely for sabotage.

This action was brought by law enforcement, which is the body to watch for further updates, with international cooperation across multiple jurisdictions.

In the October attack, the attackers took remote control of Danfoss and Dixell refrigeration controllers through web interfaces, the prosecutor's office said in a press release.

The C4 brings together France's national cybersecurity agency (ANSSI), the DGSE and DGSI security services, the armament directorate and the cyber defense command.

Iran is now dealing with an active legal process, with the agency involved leading the action.

Prosecutors said the criminal investigation, run by France's anti-cybercrime office (OFAC) and the DGSI, found an attack method typical of the unit.

The alert, last updated on October 16, warned that attack campaigns against this equipment were probably still underway, and that exposing a management interface to the internet goes against good practice.

If your environment shows any indicators associated with Iran, don't assume this action alone removed that exposure -- check for persistence regardless of the takedown.

Treat this as a disruption worth noting, not a reason to deprioritize monitoring for the same group's affiliates or rebrands.

They started abnormal defrost cycles with no time limit and switched off the temperature probes' safety alerts, which should go off above a certain temperature.