{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/nation-state-actor/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":["IRGC"],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["high"],"_cs_tags":["industrial-control-systems","nation-state-actor","sabotage","ics"],"_cs_type":"threat","_cs_vendors":[],"content_html":"\u003cp\u003eThe French Centre de Coordination des Crises Cyber (C4), an interministerial body comprising ANSSI, COMCYBER, DGA, DGSE, and DGSI, has formally attributed a series of disruptive cyber operations to the IRGC-affiliated units \u0026quot;Shahid Shoostari\u0026quot; and \u0026quot;Shahid Kaveh.\u0026quot;\u003c/p\u003e\n\u003cp\u003eThese operations, aimed at destabilization, date back to at least 2020. Notable incidents include targeting the Charlie Hebdo media outlet in 2023 and a French video display enterprise during the Paris 2024 Olympic and Paralympic Games. Most recently, on October 11 and 12, 2026, the units conducted an aggressive and unprecedented attack targeting industrial refrigeration controllers within France.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eObserved impact includes the disruption of industrial control systems, specifically refrigeration controllers, and previous historical disruption of public-facing media and event-related digital display infrastructure.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eInventory and audit internet-exposed industrial control systems (ICS/SCADA), specifically refrigeration management controllers, to ensure they are not directly accessible from the public internet.\u003c/li\u003e\n\u003cli\u003eImplement strict network segmentation between IT and OT environments, applying the principle of least privilege to remote management interfaces.\u003c/li\u003e\n\u003cli\u003eReview and reinforce monitoring for anomalous traffic patterns directed toward industrial control hardware.\u003c/li\u003e\n\u003cli\u003eIntegrate threat intelligence reporting from the ANSSI/CERT-FR bulletins into SOC threat hunting cycles to identify future activity associated with these IRGC units.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-11-09T22:11:27Z","date_published":"2026-11-09T22:11:27Z","id":"https://feed.craftedsignal.io/briefs/2026-11-iranian-irgc-cyber-ops/","summary":"The French C4 interministerial center has attributed multiple disruptive cyber operations against French national interests to Iranian IRGC-affiliated units Shahid Shoostari and Shahid Kaveh, including a recent large-scale attack against industrial refrigeration controllers.","title":"IRGC-linked cyber operations against French industrial and public targets","url":"https://feed.craftedsignal.io/briefs/2026-11-iranian-irgc-cyber-ops/"}],"language":"en","title":"CraftedSignal Threat Feed - Nation-State-Actor","version":"https://jsonfeed.org/version/1.1"}