France Attributes October Refrigeration Sabotage Campaign to Iran's Shahid Kaveh IRGC Unit

Turla APT Group Deploys Cereal Toolset to Intercept Emails on Microsoft Exchange Servers

The Russian state-backed threat group Turla has been using a new malicious toolset called Cereal to intercept emails on Microsoft Exchange servers at government organizations. Researchers at cybersecurity company ESET documented the attacks in late 2025, initially finding modular .NET malware for Microsoft Exchange at a government body in Kazakhstan. A month later, ESET found the same toolset at a government agency in Romania, where it selectively gathered email correspondence with representatives of NATO and the EU. In the campaign, the hackers use the Cereal toolset, and specifically a component named CerealBox, to inject into Exchange’s EdgeTransport.exe process and hijack existing transport agents’ handlers. The malware executes commands in memory and can inspect email content without registering a new transport agent or interrupting normal email delivery. Another component, CerealNeuron, awaits incoming encrypted web requests on paths resembling legitimate Exchange services, which carry commands for execution via CerealRunner. ESET observed no external C2 infrastructure, leaving the compromised Exchange server itself to serve as the only control point, and uncovered a variant called CerealHermit as a fallback mechanism.

France Attributes Large-Scale Cyber Sabotage of Supermarket Refrigeration Systems to Iranian Revolutionary Guard

France has formally blamed Iran’s Islamic Revolutionary Guard Corps for a major cyberattack that disrupted refrigeration systems in hundreds of supermarkets across the country. Prosecutors identified the Shahid Kaveh group as the perpetrator and opened a judicial investigation into organized cybercrime committed in the interests of a foreign power. The October 12 incident caused temperatures in affected stores to reach 50°C for six hours, resulting in massive food spoilage and tens of millions of euros in losses for chains such as Intermarché. French authorities summoned the Iranian ambassador, announced plans for European sanctions, and requested international arrest warrants for the group’s leaders. ANSSI also linked the Shahid Shoostari group, another IRGC-affiliated unit, to earlier attacks on Charlie Hebdo and the Paris 2024 Olympic Games organizing committee. Similar refrigeration-related incidents were reported in several other European countries during the same period.

France Attributes October Supermarket Refrigeration Attacks to Iranian IRGC Unit Shahid Kaveh

France has officially blamed the Iranian state-backed group Shahid Kaveh, part of the IRGC's cyber center, for cyberattacks that hit more than 700 retail locations on October 11-12. Attackers compromised industrial refrigeration controllers and altered defrost settings to high temperatures, leading to widespread food spoilage and at least 15 fires. The incidents affected major chains including Casino, Leclerc, Carrefour, and Intermarché, as well as smaller facilities, resulting in tens of millions of euros in losses. French authorities also linked the same campaign to reconnaissance and limited incidents against Schneider Electric equipment at hydroelectric sites. Attribution relied on infrastructure reuse, FOFA searches, Farsi traces, and early claims on the associated outlet CyberbanNews. France plans to summon Iran's ambassador and push for new EU sanctions while noting a separate November wave remains unattributed.