Inside Iran’s cyber-hacking operations: The three men France has linked to fridge attacks

France has identified three Iranian men it links to cyber operations against the country's interests, including attacks that disrupted refrigeration systems at about 700 commercial sites last month.

“A terrorist organisation has committed an attack of unprecedented scale and aggression against our country,” French Foreign Minister Jean Noel Barrot said on Tuesday.

The government had summoned the Iranian ambassador to Paris, he told France Info radio. “That is the very least we can do to express our strongest protests,” Mr Barrot said. He has requested that European sanctions be imposed on all of those responsible.

The three were accused over attacks that took place on the night of October 11-12. Investigators said hackers forced the defrost settings of refrigeration controllers to high temperatures, causing substantial loss of stock and at least 15 fires.

They are Hamid Reza Lashgarian, head of the Islamic Revolutionary Guard Corps’ Cyber-Electronic Command, and Mahdi Lashgarian and Reza Salarvand, identified as commanders of its Shahid Kaveh cyber-offensive unit. Iran has not acknowledged responsibility for the attacks.

Their names and photographs appeared in an appendix to a five-page report published on Monday by French cybersecurity and intelligence agencies. The document gives few biographical details. US sanctions announcements, cybersecurity investigations and media reporting offer some insight into their backgrounds and the organisation behind the attacks.

Hamid Reza Lashgarian, 65, was identified by the US Treasury as head of the IRGC-CEC and a commander in the Quds Force, the IRGC's foreign operations arm. Washington imposed sanctions on him in February 2024, saying he had been involved in IRGC cyber and intelligence operations.

In August, the US placed a bounty of up to $10 million for information on him, among others.

Different guises

His name appeared online in 2017, and investigations have linked him to several IRGC-affiliated research and technology organisations, including the Kavosh Centre, Nasr Centre, Kousar Com Research Group and Deep Com Asia.

Mahdi Lashgarian, 37, was sanctioned by the US Treasury – alongside Hamid Reza Lashgarian – and is described as a senior IRGC-CEC official. France identifies him as a commander of Shahid Kaveh, the unit it blames for the refrigeration attacks. Little about his background or responsibilities has been independently corroborated. He also has a $10 million American bounty on his head.

Shahid Kaveh operates through online identities, including the CyberAveng3rs group that is affiliated with the IRGC-CEC and has claimed responsibility for various operations.

The US Cyber Defence Agency has accused CyberAveng3rs of being behind a November 2023 campaign that targeted American industry, causing “disruptive effects”. It said the group has many guises, including Hydro Kitten, Storm-0784 and APT Iran.

Show caption: Boxes of perished goods outside a supermarket in Paris, the …

Reza Salarvand was named in 2021 in documents attributed to Shahid Kaveh’s Intelligence Group 13. Iranian opposition media abroad reported that he is 35, graduated in information technology engineering from Islamic Azad University’s south Tehran branch in 2017 and heads the group.

Sky News, which reported on the same documents in 2021, quoted a source who named Hamid Reza Lashgarian as the person overseeing the sub-unit. The documents compiled intelligence on potential targets for cyber operations, including cargo ships, petrol stations and maritime communications systems. A photograph published in September 2022 was presented in opposition media as further evidence of his identity. None of these details has been independently established to the same degree as his identification in the French statement.

Wider network

The statement places Shahid Kaveh within the IRGC-CEC as a cyber-offensive unit responsible for large-scale campaigns against industrial equipment. Its operations have principally targeted Israeli and US interests but have also extended to France and other European countries.

French agencies attributed the operation to Shahid Kaveh based on several indicators, including reused digital infrastructure, use of the Fofa scanning tool, Farsi-language traces and claims relayed by the unit’s online outlet, CyberbanNews.

The French statement also links the unit to a November 2023 campaign against Israeli industrial-control manufacturer Unitronics and to sabotage operations targeting Israeli and US interests in March and April of this year.

France distinguishes Shahid Kaveh from another IRGC-CEC unit, Shahid Shoostari, also known as Emennet Pasargad. It connects that unit to operations against the satirical magazine Charlie Hebdo, including the hacking of its online shop in January 2023, and to a compromise of a French video-display company in July 2024 ahead of the Paris Olympics.