When supermarket fridge temperatures across France began to soar in October, spoiling millions of euros worth of food, suspicion fell almost immediately on Russia.
But on Monday, the French foreign minister identified an Iranian hacking group as responsible for the cyber attack, which he described as “unprecedented in both its scale and its level of aggression”.
Shahid Kaveh, the accused cyber warfare unit, sits deep inside the Islamic Revolutionary Guard Corps (IRGC).
The commander of the shadowy formation has a $10m (£7.4m) US bounty on his head and now faces an international arrest warrant from a Western government.
For years, the unit has lurked in the networks of its enemies, pre-positioning malware inside water plants, power grids and fuel systems from the United States to Israel.
Last month it arrived inside the fridges of Europe’s supermarkets.
The fridge attacks , which began in France and extended across Europe, thrust into public view a unit that normally operates in the dark. Western governments have said it is among the most dangerous instruments in Iran’s arsenal of deniable digital war.
The Paris prosecutor’s office said it had requested international arrest warrants for the head and two deputies of Shahid Kaveh. It said that the hack bore the unit’s signature and relied on Persian-language tooling and Iranian IP addresses.
The fridge sabotage is one of the most sophisticated cyber attacks Iran has carried out since the US waged war on it in February.
US military commissary fridges also failed in August in what the Pentagon is treating as a suspected cyberattack , with Iran among the suspects.
At the centre of these operations is Shahid Kaveh and its most active tactical cell, known as Intelligence Group 13.
It is a disciplined unit fusing cyber espionage, industrial sabotage and psychological warfare. It specialises in attacks on critical infrastructure including water systems, electrical grids, fuel-distribution networks and the programmable logic controllers that run industrial machinery.
Like many IRGC formations, the unit takes the honorific “Shahid”, or martyr, from Gen Mahmoud Kaveh, a fallen commander and celebrated IRGC officer killed in 1986 during the Iran-Iraq war.
Gen Kaveh led elite operations against separatist and anti-government groups in Iranian Kurdistan.
The man identified as the unit’s supervisory chief is Gen Hamidreza Lashgarian, a senior IRGC cyber official tied to both the IRGC Electronic Warfare and Cyber Defence Organisation and to Quds Force Unit 300.
Washington’s Rewards for Justice programme lists him among the IRGC’s key leaders.
A 61-year-old from Tehran and assistant professor at the IRGC’s Imam Hossein University, Gen Lashgarian has been the overseer of Intelligence Group 13, which has targeted Western shipping and infrastructure such as fuel pumps worldwide.
Kylie Moore-Gilbert, the British-Australian academic held in Iran for 804 days, identified a man she knew as her interrogator, under an alias, as Gen Lashgarian.
Beneath him is Reza Salarvand as Group 13’s field commander and Mohammad Bagher Shirinkar as a key link to the contractor firms that supply the unit’s tools.
That contractor web is central to how the IRGC operates and hides.
Iran’s offensive cyber work is farmed out to a shifting constellation of companies that pose as cybersecurity vendors, AI startups or IT labs while serving the IRGC, dissolving and reforming to outrun sanctions.
Shahid Kaveh pairs its sabotage with a loud propaganda arm.
A network called CyberAveng3rs amplifies the unit’s intrusions, publishing defacement screenshots and taunts laced with “martyr quotes and anti-Zionist rhetoric”, issuing pre-attack warnings and boasting them afterwards.
The aim, analysts say, in addition to the disruption, is to project defiance and sow fear.
The fridge campaign marks a notable shift because the group has moved away from regular targets such as power grids towards the mundane machinery of supermarkets, where defences are weak and the effects are immediate.
Cybersecurity experts say that many of the fridges were obsolete or running outdated firmware, making them easy to breach.
For Tehran officials, it is a cheap and deniable way to make ordinary Europeans feel a war being fought thousands of miles away.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
