Dixell

France Attributes October Refrigeration Sabotage Campaign to Iran's Shahid Kaveh IRGC Unit

French authorities have formally attributed a large-scale October cyber sabotage operation targeting refrigeration controllers at roughly 700 retail locations to the Shahid Kaveh cyber unit of Iran's Islamic Revolutionary Guard Corps. Attackers remotely accessed Danfoss and Dixell controllers on 11 October, altered defrost settings to maximum temperatures, disabled safety alerts, and triggered food spoilage plus at least 20 fires. The same infrastructure and techniques were used for reconnaissance against Schneider Electric equipment at small hydroelectric sites. France's C4 coordination center cited infrastructure reuse, FOFA scanning tool usage, Persian-language traces, and early propaganda claims by linked accounts as key attribution indicators. Judicial authorities have opened an investigation, requested international arrest warrants, and plan to seek EU sanctions against involved Iranian entities. CERT-FR issued detailed remediation guidance for both compromised and uncompromised Danfoss, Dixell, and Copeland devices emphasizing removal of internet exposure and secure VPN access only.