What does a cyberattack on hundreds of supermarket refrigerators in France have to do with attacks on American water systems? More than you might think.
France has attributed the October sabotage of refrigeration systems at around 700 retail sites to Shahid Kaveh, an offensive cyber unit affiliated with the Electronic and Cyber Center of Iran’s Islamic Revolutionary Guard Corps (IRGC). Attackers manipulated refrigeration controllers, triggering abnormal defrost cycles and disabling temperature alerts. The incidents caused widespread food losses and, according to French authorities, fires at several locations.
The name Shahid Kaveh may be new to many. Its activity is much more familiar.
CyberAv3ngers is one of the public-facing personas associated with the Shahid Kaveh unit, according to the recent French attribution. Check Point Research has been following CyberAv3ngers activity for years, particularly its interest in operational technology (OT) and industrial control systems. The latest events in France put that history into a new context.
A Timeline of CyberAv3ngers and Shahid Kaveh Activity
2023: CyberAv3ngers targets water infrastructure
In 2023, Check Point Research documented CyberAv3ngers activity following attacks against critical infrastructure in the United States.
The group targeted Unitronics programmable logic controllers used by organizations including water utilities. Our research highlighted how CyberAv3ngers was expanding beyond its traditional focus on Israel and increasingly claiming attacks against organizations in the United States, often framing Israeli-made technology itself as a target.
Following this activity, CISA and other U.S. authorities published an advisory detailing IRGC-affiliated cyber activity targeting Unitronics programmable logic controllers across multiple U.S. organizations, including water and wastewater facilities.
There was another important characteristic to this activity. Check Point Research observed Iranian-affiliated hacktivist groups combining genuine attacks with recycled, exaggerated and potentially false claims. This made separating the technical activity from the information operation surrounding it increasingly important.
March 2026: Attention turns again to exposed industrial systems
During Epic Fury in March 2026, Check Point Research continued tracking activity associated with CyberAvengers.
Our researchers identified scanning activity targeting internet-exposed Virtual Network Computing (VNC) services at Israeli industrial facilities. The scanning originated from virtual private server infrastructure associated with CyberAv3ngers, providing another indication of the group’s continued interest in exposed technology within industrial environments.
The activity reinforced a pattern researchers had already seen: internet-exposed technology used in industrial environments can give attackers opportunities to identify and potentially reach systems responsible for physical processes.
October 2026: Refrigeration systems across France are attacked
Then came France.
During the night of October 11 to 12, attackers compromised refrigeration controllers across around 700 French retail sites. According to the French investigation, the attackers remotely manipulated Danfoss and Dixell refrigeration controllers, raised defrost settings and disabled temperature safety alerts.
The consequences moved quickly beyond the digital world. Retailers lost large quantities of perishable food, with French authorities estimating losses in the tens of millions of euros, while fires were reported at multiple locations.
France attributed the destructive activity to Shahid Kaveh, identifying CyberAveng3rs among its public-facing personas.
Why Operational Technology Is an Important Part of the Story
Taken together, these incidents illustrate why attacks against operational technology deserve particular attention.
We are not only talking about computers, emails or corporate networks. Connected technology increasingly controls processes in the physical world: refrigeration, water treatment, manufacturing equipment, energy systems and other industrial operations. That changes the potential impact of a cyberattack.
In the incidents documented by Check Point Research in 2023, CyberAv3ngers targeted programmable controllers used in critical infrastructure. In France, the latest attributed activity affected the technology responsible for maintaining refrigeration temperatures.
Different systems, different incidents, but a common lesson: when operational technology is exposed to the internet, a cyber intrusion can potentially translate into physical disruption.
From CyberAv3ngers to Shahid Kaveh
The French attribution also helps put years of activity under CyberAv3ngers into a wider organizational context. Check Point Research’s earlier analysis identified CyberAv3ngers as an Iranian government and IRGC-affiliated public facing persona. For defenders, the name matters less than the behavior behind it. The progression from attacks on water infrastructure to reconnaissance of industrial systems and now disruptive activity against refrigeration infrastructure shows why exposed OT environments remain an important area to monitor.
As geopolitical tensions evolve, Check Point Research will continue tracking Iranian cyber activity and the infrastructure, techniques and personas associated with it.
Follow Check Point Research for the latest insights into Iranian cyber activity and emerging threats.
