The French government has accused Shahid Kaveh – a group it says is linked to Iran’s Islamic Revolutionary Guard Corps (IRGC) – of being behind recent cyberattacks targeting refrigerators in French supermarkets.
The alleged sabotage campaign last month hacked into refrigeration systems in hundreds of stores in France and remotely cranked up temperatures, spoiling millions of euros’ worth of food.
France’s Foreign Minister Jean-Noel Barrot has called the attack “unprecedented in its level of aggression”.
But in a statement on Tuesday, Iran denied any role in the cyberattacks.
Here’s what we know about Shahid Kevah and its alleged involvement:
French officials have accused the IRGC of orchestrating the October 11-12 cyberattack, which they say targeted 700 commercial sites across France.
In a statement, the Paris prosecutor’s office specifically blamed Shahid Kaveh, which it described as a “an offensive cyberunit” affiliated with the IRGC’s cyberelectronic command (CEC).
A report published by France’s spy and cyberagencies also named three alleged perpetrators – Hamid Reza Lashgarian, who it described as the head of the CEC, and Mahdi Lashgarian and Reza Salarvand, who it identified as commanders in the Shahid Kaveh unit.
Iran pushed back against the accusations on Tuesday, calling them “baseless and biased”.
The Iranian Foreign Ministry, in a statement, described the accusations as a “highly irresponsible and contemptible action to tarnish Iran’s image and disrupt its relations with other countries”.
The statement warned that Tehran would not hesitate to take measures to safeguard its national interests and security.
It made no mention of the Shahid Kaveh unit.
Iran’s government has never publicly acknowledged the existence or purpose of the group, which appears to be named after Mahmoud Kaveh, an IRGC commander who died aged 25 in 1986 during the Iran-Iraq war.
But Western intelligence agencies have linked it to the IRGC, assessing that it is part of a network of hackers operating under Tehran’s direction.
In their recent report, French spy and cyber agencies said Shahid Kaveh operates through numerous front groups posing as vigilante hackers, including “CyberAveng3rs” and “Cyber Isnaad Front.”
Those front groups, it said, “are tasked with publicly claiming responsibility for certain attacks carried out by the Shahid Kaveh unit”.
Two of the alleged associates named by French intelligence agencies – Hamid Reza Lashgarian and Mahdi Lashgarian – have previously been sanctioned by the US over alleged ties to the IRGC’s cyberunit.
Iran has extensive cybercapabilities that it is increasingly using to advance its wartime objectives, say experts.
Nikita Shah, a senior fellow with the Intelligence, National Security, and Technology programme at the Center for Strategic and International Studies (CSIS), says there has been a “notable uptick in Iran’s cyberoperations since March 2026”, including “cyberespionage” and “conflict-themed cybercrime”.
“Iran’s cyberoperators will likely be working on preparing new technical accesses, and possibly new cyber capabilities to leverage, should the conflict continue over the longer term or negotiations falter,” Shah wrote in an August analysis for CSIS.
A 2025 policy report by the United Kingdom Parliament’s Intelligence and Security Committee describes Iran as “an aggressive cyberactor with extensive capabilities”.
While Iran’s cybercapacity is not as sophisticated as Russia’s or China’s, according to the report, Tehran is adept at using basic exploitation methods against its adversaries.
“Whilst Iranian cyberactors often use simple computer network exploitation techniques, they use them very effectively, exploiting basic vulnerabilities that many organisations have, including in the UK,” said the report.
Cyberoperations are also a “deniable tool” that Iran can use to “attack its enemies, respond to perceived aggression and project power in the region – and globally,” the report added.
The IRGC and affiliated groups have been linked to past cyberattacks on targets in the United States and Israel, including water infrastructure.
One wave of attacks in late 2023 targeted US water facilities that relied on a computer system made by Israeli software firm Unitronics, according to US cybersecurity officials.
Earlier this year, Iran-affiliated hackers also went after industrial control technology used in US infrastructure, including at government facilities, US security agencies warned. The hackers were able to disrupt some programmable logic controllers (PLCs) — technology that helps automate and monitor machinery and manufacturing processes — across several US critical infrastructure sectors, causing “operational disruption and financial loss”, the US agencies said.
And in March this year, an Iran-linked hacking group claimed to carry out a destructive cyberattack on US-based medical device provider, Stryker.
The recent French intelligence report said attacks by Shahid Kaveh and its affiliated groups have been “primarily directed against Israel and the United States, but also against France and other European countries”.
