IRGC-linked cyber operations against French industrial and public targets

The French Centre de Coordination des Crises Cyber (C4), an interministerial body comprising ANSSI, COMCYBER, DGA, DGSE, and DGSI, has formally attributed a series of disruptive cyber operations to the IRGC-affiliated units "Shahid Shoostari" and "Shahid Kaveh."

These operations, aimed at destabilization, date back to at least 2020. Notable incidents include targeting the Charlie Hebdo media outlet in 2023 and a French video display enterprise during the Paris 2024 Olympic and Paralympic Games. Most recently, on October 11 and 12, 2026, the units conducted an aggressive and unprecedented attack targeting industrial refrigeration controllers within France.

Impact

Observed impact includes the disruption of industrial control systems, specifically refrigeration controllers, and previous historical disruption of public-facing media and event-related digital display infrastructure.

Recommendation

1. Inventory and audit internet-exposed industrial control systems (ICS/SCADA), specifically refrigeration management controllers, to ensure they are not directly accessible from the public internet.
2. Implement strict network segmentation between IT and OT environments, applying the principle of least privilege to remote management interfaces.
3. Review and reinforce monitoring for anomalous traffic patterns directed toward industrial control hardware.
4. Integrate threat intelligence reporting from the ANSSI/CERT-FR bulletins into SOC threat hunting cycles to identify future activity associated with these IRGC units.