Who are Shahid Kaveh? Iranian cybercriminal gang blamed for France supermarket fridge hack

Want to bookmark your favourite articles and stories to read or reference later? Start your Independent Membership today.

Already a member? Log in

France has accused Iran of using a specialist cyber unit to launch virtual attacks on its supermarkets, causing fridges to turn up their heat dials across the country.

Commercial fridges and freezers lost power across France last month in incidents costing tens of millions of euros, according to some industry experts.

Approximately 700 supermarkets were impacted and 15 fires broke out as heat dials were turned up by hackers.

French foreign minister ⁠Jean-Noel Barrot said he had summoned Iran’s ambassador over what he called “unacceptable cyberattacks conducted by the Islamic Republic of Iran”.

“This is an attack of unprecedented scale and aggressiveness,” Mr Barrot said. “It is the first large-scale cyber attack aimed at sabotage on French soil, and it represents a major threat to our national interests and the security of the French people. That is why it will not go unanswered.”

Who are Shahid Kaveh?

The group are described as a “cyber unit” affiliated with the Islamic Revolutionary Guard Corps .

Shahid Kaveh loosely translates as shahid meaning martyr, and Kaveh is thought to be named after a revolutionary guard commander who died in the 1980s. The group of hackers are believed to be working with the Iranian government and military.

French investigators have narrowed down three individuals who they believe are responsible, including the head of the IRGC-ECC (the Electronic and Cyber Center of the IRGC) Hamid Reza Lashgarian, according to Le Monde . Lashgarian, 65, is also a commander in the Quds Force and is a key figure in the military’s cyber apparatus.

Since 2024, he has been subject to US sanctions.

Two others within the unit have also been named including Reza Salarvand, 35, a computer science graduate from a Tehran university and Mahdi Lashgarian, 37. The Paris prosecutor’s office has requested an international arrest warrant for the trio.

According to Le Monde, the group was originally known under the name CyberAveng3rs.

How did they carry out the hack?

It is unclear how exactly the hackers were able to infiltrate supermarket freezers remotely and inflict damage across various locations simultaneously.

Some supermarket refrigeration units use software to regulate temperatures across multiple locations. Hackers are thought to have broken into this software to turn up the heat in the units, causing havoc across the country.

Several specialist cybercrime and security units were devoted to the task of pinning down the culprits in France. The teams were able to pick up traces of Persian in code and identify IP addresses that led them back to Shahid Kaveh.

What else have they been blamed for?

According to a 2020 Sky News investigation, the group initially sought to disrupt satellite systems and inflict damage on merchant ships. France appeared to be of the greatest interest to the hackers, according to Le Monde.

The group carried out cyber-attacks on the power grid in Israel after the October 7 attacks by Hamas and in the US in November 2023 against a municipal water authority, according to cybersecurity firm Dragos .

In the attack on water management in the US, the hackers used their tools to display a message of support for Gaza.

Le Monde said that their main purpose was to propaganda and they were not considered a major player until recently.

Join our commenting forum

Join thought-provoking conversations, follow other Independent readers and see their replies