France Attributes Large-Scale Cyber Sabotage of Supermarket Refrigeration Systems to Iranian Revolutionary Guard

Turla APT Group Deploys Cereal Toolset to Intercept Emails on Microsoft Exchange Servers

The Russian state-backed threat group Turla has been using a new malicious toolset called Cereal to intercept emails on Microsoft Exchange servers at government organizations. Researchers at cybersecurity company ESET documented the attacks in late 2025, initially finding modular .NET malware for Microsoft Exchange at a government body in Kazakhstan. A month later, ESET found the same toolset at a government agency in Romania, where it selectively gathered email correspondence with representatives of NATO and the EU. In the campaign, the hackers use the Cereal toolset, and specifically a component named CerealBox, to inject into Exchange’s EdgeTransport.exe process and hijack existing transport agents’ handlers. The malware executes commands in memory and can inspect email content without registering a new transport agent or interrupting normal email delivery. Another component, CerealNeuron, awaits incoming encrypted web requests on paths resembling legitimate Exchange services, which carry commands for execution via CerealRunner. ESET observed no external C2 infrastructure, leaving the compromised Exchange server itself to serve as the only control point, and uncovered a variant called CerealHermit as a fallback mechanism.

France Attributes October Refrigeration Sabotage Campaign to Iran's Shahid Kaveh IRGC Unit

French authorities have formally attributed a large-scale October cyber sabotage operation targeting refrigeration controllers at roughly 700 retail locations to the Shahid Kaveh cyber unit of Iran's Islamic Revolutionary Guard Corps. Attackers remotely accessed Danfoss and Dixell controllers on 11 October, altered defrost settings to maximum temperatures, disabled safety alerts, and triggered food spoilage plus at least 20 fires. The same infrastructure and techniques were used for reconnaissance against Schneider Electric equipment at small hydroelectric sites. France's C4 coordination center cited infrastructure reuse, FOFA scanning tool usage, Persian-language traces, and early propaganda claims by linked accounts as key attribution indicators. Judicial authorities have opened an investigation, requested international arrest warrants, and plan to seek EU sanctions against involved Iranian entities. CERT-FR issued detailed remediation guidance for both compromised and uncompromised Danfoss, Dixell, and Copeland devices emphasizing removal of internet exposure and secure VPN access only.

France Attributes October Supermarket Refrigeration Attacks to Iranian IRGC Unit Shahid Kaveh

France has officially blamed the Iranian state-backed group Shahid Kaveh, part of the IRGC's cyber center, for cyberattacks that hit more than 700 retail locations on October 11-12. Attackers compromised industrial refrigeration controllers and altered defrost settings to high temperatures, leading to widespread food spoilage and at least 15 fires. The incidents affected major chains including Casino, Leclerc, Carrefour, and Intermarché, as well as smaller facilities, resulting in tens of millions of euros in losses. French authorities also linked the same campaign to reconnaissance and limited incidents against Schneider Electric equipment at hydroelectric sites. Attribution relied on infrastructure reuse, FOFA searches, Farsi traces, and early claims on the associated outlet CyberbanNews. France plans to summon Iran's ambassador and push for new EU sanctions while noting a separate November wave remains unattributed.