French ANSSI Report Links IRGC Shahid Kaveh to 700 Refrigeration Controller Intrusions

The five-page ANSSI-coordinated document details reconnaissance on industrial controllers, deployment of custom malware against refrigeration units, and resulting fires at 15 sites plus widespread spoilage. Evidence includes Persian-language strings, shared infrastructure with earlier US OT hits, and named operators Hamid Reza Lashgarian, Mahdi Lashgarian, and Reza Salarvand. The report omits the November wave that struck blood service sites and meat processors across 11 countries.

US CISA and NSA advisories from 2023-2024 already mapped the same Shahid Kaveh alias CyberAv3ngers to water utility PLC disruptions; French investigators added fresh OT targeting of hydroelectric sites and food chain assets. Official attribution rests on tooling overlap and infrastructure reuse rather than public packet captures or malware samples, leaving independent verification dependent on closed intelligence channels.

The pattern shows IRGC units shifting from website defacements to kinetic-effect OT operations on non-traditional targets like cold chains and small hydro. France's judicial warrants and sanctions push coincide with EU discussions on expanding dual-use export controls; expect further European enforcement actions against IRGC-linked contractors within 60 days if additional incidents surface.