French authorities have accused an Iranian cyber unit, known as Shahid Kaveh, of masterminding a series of cyberattacks that targeted refrigerators in supermarkets across France last month. The alleged assault disrupted the temperature control systems in hundreds of stores, resulting in significant food waste and financial losses. According to reports, French intelligence claims that Shahid Kaveh is an offensive cyber unit affiliated with the Islamic Revolutionary Guard Corps (IRGC)’s cyberelectronic command (CEC). The Paris prosecutor's office specifically mentioned Shahid Kaveh as being responsible for the cyberattacks on over 700 commercial sites in France. Three alleged perpetrators have been named in a report by French spy and cyber agencies – Hamid Reza Lashgarian, described as the head of the CEC, along with Mahdi Lashgarian and Reza Salarvand, identified as commanders in Shahid Kaveh unit. Iran has denied any involvement in these attacks, calling the accusations baseless and biased. The Iranian Foreign Ministry issued a statement warning that Tehran would take measures to safeguard its national interests and security without mentioning Shahid Kaveh directly. Despite Iran's denial of the group’s existence, Western intelligence agencies have linked it to the IRGC, assessing it as part of a network of hackers operating under Tehran's direction.
Furthermore, French spy and cyber agencies claim that Shahid Kaveh operates through front groups posing as vigilante hackers such as "CyberAveng3rs" and "Cyber Isnaad Front." These front groups reportedly take credit for attacks carried out by the Shahid Kaveh unit. The United States has previously sanctioned two of the alleged associates named by French intelligence agencies – Hamid Reza Lashgarian and Mahdi Lashgarian – over their alleged ties to the IRGC’s cyberunit.
Iran is known for its expanding cyber capabilities, with experts suggesting a notable uptick in Iran's cyber operations since March 2026, including cyberespionage and conflict-themed cybercrime. The UK Parliament’s Intelligence and Security Committee describes Iran as “an aggressive cyberactor with extensive capabilities,” although its cybercapacity is not considered as sophisticated as Russia or China’s. Cyberoperations serve as a deniable tool for Iran to attack adversaries, respond to perceived aggression, and project power regionally and globally. The IRGC and affiliated groups have been linked to past cyberattacks on targets in the United States and Israel, including critical water infrastructure and industrial control technology used in US infrastructure.
In light of these developments, it appears that Iran's Shahid Kaveh unit may be playing a significant role in escalating international cyber conflicts. The implications of this are far-reaching, particularly given Iran’s growing cyber capabilities and its history of conducting disruptive attacks against various targets worldwide.